AUTOMATED DETECTION OF ANOMALIES IN CORPORATE WIRELESS NETWORK TRAFFIC USING PYTHON: METHODS, IMPLEMENTATION, AND EFFECTIVENESS EVALUATION

This article presents the results of a study focused on the development and comparative evaluation of models for automated anomaly detection in corporate wireless network traffic. The introduction substantiates the relevance of cybersecurity challenges in the context of increasing Wi-Fi traffic volumes and the growing complexity of attack types, which necessitate the use of intelligent intrusion detection systems. The theoretical foundations section reviews signature-based and behavioral analysis concepts, IDS/WIDS system principles, and modern approaches to anomaly detection using machine learning and deep learning. Special attention is given to explainable artificial intelligence (XAI) and its role in enhancing model transparency. The data selection and preprocessing section describes the use of two representative datasets — AWID-3 and UNSW-NB15 — covering a wide range of attacks and normal traffic. Preprocessing steps included data cleaning, normalization, categorization, and class balancing using SMOTE and random undersampling. The implementation section outlines the architectures of SVM, Random Forest, XGBoost, and CNN-GRU models, using Scikit-learn, TensorFlow, Keras, and SHAP libraries. The CNN-GRU model combines convolutional and recurrent layers, enabling effective processing of temporal dependencies in traffic data. The comprehensive model evaluation section compares performance across accuracy, latency, explainability, and stability metrics. CNN-GRU achieved the highest classification accuracy, while XGBoost demonstrated the best balance between precision and responsiveness. SHAP visualizations revealed that session duration, packet count, and protocol type are the most influential features. Stability analysis under noisy conditions, variable load, and limited training data confirmed the advantages of adaptive architectures. The conclusions summarize the findings and outline future research directions: integration of models into real-world corporate systems, enhancement of explainability, deployment in 5G/6G and IoT environments, and automation of architecture design using meta-learning techniques.

Authors

Institutions

Publication Details

Journal
Cybersecurity Education Science Technique
Published
2025-01-01
DOI
https://doi.org/10.28925/2663-4023.2025.29.939
Primary Topic
Anomaly Detection Techniques and Applications
Type
article
Field-Weighted Citation Impact
0.00
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
article

AUTOMATED DETECTION OF ANOMALIES IN CORPORATE WIRELESS NETWORK TRAFFIC USING PYTHON: METHODS, IMPLEMENTATION, AND EFFECTIVENESS EVALUATION

Artem Platonenko, Izabella Sobolenko
Cybersecurity Education Science Technique
Anomaly Detection Techniques and Applications
article

AUTOMATED DETECTION OF ANOMALIES IN CORPORATE WIRELESS NETWORK TRAFFIC USING PYTHON: METHODS, IMPLEMENTATION, AND EFFECTIVENESS EVALUATION

Artem Platonenko, Izabella Sobolenko
article en

Abstract

This article presents the results of a study focused on the development and comparative evaluation of models for automated anomaly detection in corporate wireless network traffic. The introduction substantiates the relevance of cybersecurity challenges in the context of increasing Wi-Fi traffic volumes and the growing complexity of attack types, which necessitate the use of intelligent intrusion detection systems. The theoretical foundations section reviews signature-based and behavioral analysis concepts, IDS/WIDS system principles, and modern approaches to anomaly detection using machine learning and deep learning. Special attention is given to explainable artificial intelligence (XAI) and its role in enhancing model transparency. The data selection and preprocessing section describes the use of two representative datasets — AWID-3 and UNSW-NB15 — covering a wide range of attacks and normal traffic. Preprocessing steps included data cleaning, normalization, categorization, and class balancing using SMOTE and random undersampling. The implementation section outlines the architectures of SVM, Random Forest, XGBoost, and CNN-GRU models, using Scikit-learn, TensorFlow, Keras, and SHAP libraries. The CNN-GRU model combines convolutional and recurrent layers, enabling effective processing of temporal dependencies in traffic data. The comprehensive model evaluation section compares performance across accuracy, latency, explainability, and stability metrics. CNN-GRU achieved the highest classification accuracy, while XGBoost demonstrated the best balance between precision and responsiveness. SHAP visualizations revealed that session duration, packet count, and protocol type are the most influential features. Stability analysis under noisy conditions, variable load, and limited training data confirmed the advantages of adaptive architectures. The conclusions summarize the findings and outline future research directions: integration of models into real-world corporate systems, enhancement of explainability, deployment in 5G/6G and IoT environments, and automation of architecture design using meta-learning techniques.

Cybersecurity Education Science TechniqueVol. 1(29)
Borys Grinchenko Kyiv Metropolitan University (UA)
Openalex Percentile: Top 85%
Anomaly Detection Techniques and Applications
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.