A Hybrid Approach for Detecting FTP Exploits: Integrating Isolation Forest and LSTM for Enhanced Anomaly Detection

In this paper, we respond to the rising security concerns that are cyber threats against broadly implemented protocols like FTP as prerequisites of the contemporary interconnected systems. Among all these threats, a vulnerability can threaten FTP servers and rather become dangerous for organizations. More specifically, current detection methods that hold so much promise, like the signature-based approach, are no longer effective because they cannot evolve in response to new forms of attacks or new patterns of exploitation. In response to these challenges, we propose a novel concept, a two model-based system that combines Isolation Forest (IF) for static feature anomalies and Long Short-Term Memory (LSTM) for sequential analysis anomalies in FTP traffics. This approach of IF-LSTM combination takes advantage of both architectures that facilitate accurate identification of both inherent intrusions and temporal attack patterns in real time. Substantial tests are performed on a CICIDS2017 dataset to validate that the proposed model achieves considerable detection rates and surpasses conventional detection approaches. Based on our findings, it is possible to implement feature-based and sequential methods to address the challenging cyber threats and represent a robust answer to protecting FTP servers.