[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-290888-105":59,"doc-detail-290888-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","detection-of-anomalies-in-computer-networks-using-machine-learning","Detection of Anomalies in Computer Networks using Machine Learning","","Given the rapid growth of cyberattacks, this research develops effective anomaly detection methods for computer networks. Traditional defenses based on static signatures often fail against emerging threats like zero-day attacks and polymorphic malware, creating demand for data-driven models that learn traffic behavior. Four supervised algorithms—SVM, Random Forest, LSTM, and Logistic Regression—are benchmarked on the CICIDS2017 dataset using preprocessing, normalization, feature selection, and hyperparameter tuning. F1-score is used to address dataset imbalance, yielding high performance (0.937–0.999), with Random Forest producing the best results.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/detection-of-anomalies-in-computer-networks-using-machine-learning/290888/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/detection-of-anomalies-in-computer-networks-using-machine-learning/290888.png","ImageObject",300,407,{"name":92,"@type":93},"Skyler","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-11-07","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",17,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Why are traditional signature-based IDS methods insufficient for modern threats?","Question",{"text":113,"@type":114},"They often rely on static signatures, which struggle to identify novel, encrypted, or polymorphic malicious activity such as zero-day attacks.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"Which machine learning algorithms are benchmarked in this study?",{"text":118,"@type":114},"The study compares SVM, Random Forest, LSTM, and Logistic Regression for malicious traffic recognition.",{"name":120,"@type":111,"acceptedAnswer":121},"Why is F1-score used for model evaluation instead of accuracy?",{"text":122,"@type":114},"Because CICIDS2017 has class imbalance between benign and malicious traffic, F1-score better reflects performance under skewed class distributions.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},290888,1789642898,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":39,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":46,"preview_page_count":4},2336464648746,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","Detection of Anomalies in Computer Networks using Machine  \nLearning  \nAlexandre Aparecido da Silva  \n[alexandreaparecido@alunos.utfpr.edu.br](alexandreaparecido@alunos.utfpr.edu.br)[ ](alexandreaparecido@alunos.utfpr.edu.br)Federal University of Technology – Paraná (UTFPR) Apucarana, Paraná, Brazil  \nRafael Gomes Mantovani  \n[rafaelmantovani@utfpr.edu.br](rafaelmantovani@utfpr.edu.br)[ ](rafaelmantovani@utfpr.edu.br)Federal University of Technology – Paraná (UTFPR) Apucarana, Paraná, Brazil  \nLuiz Fernando Carvalho  \n[luizfcarvalho@utfpr.edu.br](luizfcarvalho@utfpr.edu.br)[ ](luizfcarvalho@utfpr.edu.br)Federal University of Technology – Paraná (UTFPR) Apucarana, Paraná, Brazil  \nABSTRACT  \nGiven the significant growth of cyberattacks, it becomes urgent to develop effective methods for identifying anomalies in computer networks. Traditional security mechanisms, which predominantly rely on static signatures, often struggle to detect novel or sophisticated threats such as zero-day attacks and polymorphic malware. Consequently, the research community is increasingly turning towards data-driven approaches capable of learning dynamic traffic patterns to distinguish between benign behavior and malicious intent with high precision. This work benchmarks four supervised machine learning algorithms: SVM, Random Forest, LSTM, and Logistic Regression. These were applied to the recognition of malicious traffic using the CICIDS2017 dataset, which is known for its diverse set of attacks. The methodology adopted includes preprocessing, normalization, feature selection, and hyperparameter tuning for each algorithm to ensure greater reliability in the results. The F1-score metric was used for model evaluation due to the original data imbalance on the CICIDS2017 data. This methodological choice aims to minimize common distortions in real-world environments, where attacks typically constitute a minority of traffic compared to legitimate traffic. The experimental results indicated that all the algorithms obtained high F1-scores in the {0 . 937;0 . 999} interval, with the best results obtained by the RF-induced model. These findings reinforce the potential of combining machine learning techniques with updated datasets to create robust intrusion detection systems, contributing to the security of modern networks.  \nKEYWORDS  \nCybersecurity, Anomaly Detection, Machine Learning, CICIDS2017 .  \n1 INTRODUCTION  \nThe proliferation of connected devices and the exponential growth of data traffic have transformed computer networks into critical infrastructure for modern society. However, this connectivity also exposes organizations to increasingly sophisticated cyber threats [1] . As the volume and complexity of cyberattacks – such as Denial of Service (DoS), Brute Force, and web attacks—continue to increase, traditional signature-based intrusion detection systems (IDS) often struggle to identify new or encrypted malicious activity[2] . Consequently, there is an urgent need to develop more effective, adaptive methods for identifying anomalies in network traffic.  \nMachine learning (ML) has emerged as a promising approach to address these challenges, offering the ability to learn patterns from historical data and detect deviations indicative of attacks [3] . The adoption of ML in cybersecurity is driven by the limitations of  \ntraditional signature-based detection methods, which are often ineffective against novel or polymorphic threats (zero-day attacks) that lack predefined signatures. Unlike static rule sets, ML algorithms excel at analyzing high-dimensional network data to establish baselines of \"normal\" behavior, enabling the automated detection of subtle anomalies and significantly improving the scalability of defense mechanisms in real-time environments [4] . This study evaluates the performance of four distinct supervised machine learning algorithms: Support Vector Machines (SVM), Random Forest (RF), Long Short-Term Memory (LSTM), and Logistic Regress","cbCaibgSbJuphq7e","https://ap.wps.com/l/cbCaibgSbJuphq7e","pdf",578428,"English","# 1 INTRODUCTION\n# 2 BACKGROUND AND RELATED WORK\n## 2.1 Anomalies and Network Traffic","[{\"question\":\"Why are traditional signature-based IDS methods insufficient for modern threats?\",\"answer\":\"They often rely on static signatures, which struggle to identify novel, encrypted, or polymorphic malicious activity such as zero-day attacks.\"},{\"question\":\"Which machine learning algorithms are benchmarked in this study?\",\"answer\":\"The study compares SVM, Random Forest, LSTM, and Logistic Regression for malicious traffic recognition.\"},{\"question\":\"Why is F1-score used for model evaluation instead of accuracy?\",\"answer\":\"Because CICIDS2017 has class imbalance between benign and malicious traffic, F1-score better reflects performance under skewed class distributions.\"}]","Detection of Anomalies in Computer Networks using Machine Learning | PDF"]