[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-124259-en":3,"doc-seo-124259-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},124259,687197207057,"Sage","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","Uncovering Anomalies using Isolation Forest - A Machine Learning Approach for Request Analysis","Digital misconduct grows with online social networks enabling bots that masquerade as normal users. Such behaviour can include spammy emails, attempts to distribute malware, or collection of sensitive user information. This degree project investigates analyzing metadata from HTTP requests to detect patterns of anomalous behaviour, aiming to provide a machine-learning module for request analysis. After reviewing prior approaches and theory, the system is implemented with Isolation Forest, using feature engineering over request sequences and evaluating precision, recall, and F1.","Uncovering Anomalies using Isolation Forest –A Machine Learning Approach for Request Analysis  \nDegree Project in Computer Engineering  \nViktoria Hagenbo Lovisa Rosin  \nDepartment of Computer Science and Engineering  \nCHALMERS UNIVERSITY OF TECHNOLOGY Gothenburg, Sweden 2023  \n[www.chalmers.se](www.chalmers.se)  \nDegree Project 2023  \nUncovering Anomalies using Isolation Forest A Machine Learning Approach for Request Analysis  \nViktoria Hagenbo & Lovisa Rosin  \nDepartment of Computer Science and Engineering Chalmers University of Technology Gothenburg, Sweden 2023  \nUncovering Anomalies using Isolation Forest  \n-A Machine Learning Approach for Request Analysis Viktoria Hagenbo, Lovisa Rosin  \n© Viktoria Hagenbo, Lovisa Rosin, 2023 .  \nSupervisor: Peter Moberg  \nSupervisor: Neethu Bal Mallya, Department of Computer Science and Engineering Examiner: Lars Svensson, Department of Computer Science and Engineering  \nDegree Project 2023  \nDepartment of Computer Science and Engineering Chalmers University of Technology  \nSE-412 96 Gothenburg Telephone +46 31 772 1000  \nCover: The cover has been designed using an image [from Flaticon.com](from Flaticon.com).  \nTypeset in LATEX  \nPrinted by Chalmers Reproservice Gothenburg, Sweden 2023  \nUncovering Anomalies using Isolation Forest  \n-A Machine Learning Approach for Request Analysis  \nViktoria Hagenbo, Lovisa Rosin  \nDepartment of Computer Science and Engineering Chalmers University of Technology  \nAbstract  \nIn an increasingly digital era, the prevalence of misconduct increases as online social networks enable the creation of bots posing as normal users. This type of misconduct can appear in various forms, for example, emails containing unwanted advertisements, attempts of malware distribution, or simply collecting user-sensitive information. To detect this behaviour, using machine learning is well-considered and researched, especially regarding the analysis of the content of messages and online posts. This project explores the approach to analyze metadata from [HTTP requests](HTTP requests)[ ](HTTP requests)to find patterns for anomalous behavior, with the end goal being a machine learning module that can be integrated into a larger system for request analysis.  \nAfter reviewing different approaches suggested by previous research and theoretical reasoning, the proposed system has been designed and implemented using the Isolation Forest model. Feature engineering has been utilized to extract information from sequences of input requests. The system consists of two different model instances which operate on different sequence length intervals. The conclusion to use the selected models has been obtained when evaluating differently trained Isolation Forest instances using precision, recall, and the F1 score as metrics.  \nKeywords: Machine learning, Isolation Forest, Unsupervised learning, Request analysis, Anomaly detection, Feature engineering.  \nAcknowledgements  \nWe would like to acknowledge and express our gratitude to those that have helped us during this project. In particular, our technical supervisor Peter Moberg who offered an interesting outline for us to expand upon, as well as being a source of guidance for the duration of this project. We would also like to express our warmest gratitude to our supervisor Neethu Bal Mallya at Chalmers for her invaluable feedback and advise when writing this report.  \nViktoria Hagenbo, Lovisa Rosin, Gothenburg, June 2023  \nList of Acronyms  \nBelow is the list of acronyms that have been used throughout this report listed in order of appearance:  \nML Machine Learning  \nGRA Gateway Request Analyzer  \n[HTTP](HTTP) Hypertext Transfer Protocol  \nIP Internet Protocol  \nAPI Application Program Interface  \nURL Uniform Resource Locator  \nOSN Online Social Networks  \nIF Isolation Forest  \nRNN Recurrent Neural Network  \nLSTM Long-short-term-memory  \nNN Neural Network  \nFFNN Feedforward Neural Network  \nCNN Convolutional Neural Network  \nBPTT Backpropagation ","cbCaiaSeSafjd4VX","https://ap.wps.com/l/cbCaiaSeSafjd4VX","pdf",2161410,1,65,"English","en",105,"## Abstract\n## Keywords\n## Acknowledgements\n## List of Acronyms","[{\"question\":\"What problem does the project address?\",\"answer\":\"It targets detecting anomalous behaviour caused by bots that appear as normal users on online social networks. The focus is on identifying misconduct such as spam, malware distribution attempts, and sensitive information collection.\"},{\"question\":\"How does the system detect anomalies?\",\"answer\":\"The project uses the Isolation Forest model on engineered features extracted from sequences of HTTP requests. Two model instances operate on different sequence length intervals.\"},{\"question\":\"How is model performance evaluated?\",\"answer\":\"Different Isolation Forest instances are trained and evaluated using precision, recall, and the F1 score to select the final models.\"}]","Uncovering Anomalies using Isolation Forest - A Machine Learning Approach for Request Analysis | PDF",1785821264,164,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"uncovering-anomalies-using-isolation-forest-a-machine-learning-approach-for-request-analysis","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/uncovering-anomalies-using-isolation-forest-a-machine-learning-approach-for-request-analysis/124259/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the project address?","Question",{"text":75,"@type":76},"It targets detecting anomalous behaviour caused by bots that appear as normal users on online social networks. The focus is on identifying misconduct such as spam, malware distribution attempts, and sensitive information collection.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the system detect anomalies?",{"text":80,"@type":76},"The project uses the Isolation Forest model on engineered features extracted from sequences of HTTP requests. Two model instances operate on different sequence length intervals.",{"name":82,"@type":73,"acceptedAnswer":83},"How is model performance evaluated?",{"text":84,"@type":76},"Different Isolation Forest instances are trained and evaluated using precision, recall, and the F1 score to select the final models.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]