UNSUPERVISED MACHINE LEARNING METHODS FOR REAL-TIME ANOMALY DETECTION IN ENDPOINTS

Among all the contemporary digital ecosystems, endpoint devices, including computers, servers, and IoT gadgets, represent at once the most important and the most vulnerable part of the infrastructure of any organization. Traditional security solutions very often cannot identify subtle and sophisticated threats that reveal their presence only through deviations from normal behavior. This paper presents the application of unsupervised machine learning methods-namely, Isolation Forest, One-Class Support Vector Machines, Gaussian Mixture Models and Local Outlier Factor-for real-time anomaly detection in endpoint devices. The efficacy, for this purpose, is shown in this paper using comprehensive telemetry data such as CPU usage, memory consumption, and network traffic, whether anomalies due to security breaches or system malfunction can be detected using these techniques.