Real-time anomaly detection system using best performed machine learning model

Abstract

Effective anomaly detection is critical for protecting organizational networks against increasingly sophisticated cyber threats. However, most machine learning-based intrusion detection models are developed and validated using public benchmark datasets, which may not reflect the operational characteristics, traffic behavior, and threat patterns of real institutional networks. In the case of Umalusi, there is currently no anomaly detection model customized and validated using Umalusi-specific network traffic, creating a practical gap in deployable cybersecurity capability. This study proposes a hybrid machine learning framework tailored to support accurate, efficient, and operationally relevant anomaly detection. Using knowledge discovery in databases (KDD) process, network traffic data were collected and pre-processed through normalization, label encoding, missing value treatment, and dimensionality reduction using principal component analysis (PCA). The 16 hybrid models integrating unsupervised anomaly detection with supervised classification were implemented and comparatively evaluated. Experimental findings indicate that the density-based spatial clustering of applications databasescan (DBSCAN) + random forest (RF) model achieved 99.92% accuracy while maintaining a low false positive (FP) cost, making it suitable for a security operations centre (SOC). In addition, a Flask-based web application was developed to enable real-time deployment by sniffing live network traffic, executing inference, and persisting results in an SQLite database.