1
Interim Progressive Report (IPR)
Student Number Student Name
Course:
Supervised by:
Type of Proposal
2
Anomaly Detection with Isolation Forest in Websites
Introduction and Overview
In the current digital age, there has been an increase in online activities due to
the fast-growing technology and thus making a website to be the primary purpose of
many activities. The widespread use of websites has led to many fraudulent activities,
which leads to the loss of people's information and data. Many phishing attacks are
witnessed, so there is a need to address this issue. Phishing attacks involve deceiving
users so that they can give information like passwords, personal identifications, and
credit card details while they are transacting online through the impersonation of
legitimate websites (Ansari et al., 2022). This fundamental aspect of machine learning is
mainly applied in various fields, including cyber security, health, manufacturing, and
robotics. Identifying anomalies within a large dataset is crucial in detecting fraud,
system reliability, and fault diagnosis within systems. The main aim of this study is to
focus on leveraging the isolation forest algorithm to detect anomalies in websites and
thus minimize the risks of phishing attacks. The isolation forest algorithm has been
proven to be one of the most effective mechanisms for detecting anomalies, and it offers
a solution for addressing critical challenges associated with identifying unusual
instances (Carletto et al., 2023). This study will also focus on evaluating the
performance and applicability of isolation forests in anomalies detection in websites.
Research Questions/ Question
A research question acts as the guiding principle for a study. Also, it plays a
significant role in the investigation, data collection, analysis, and interpretation of the
results and the conclusion. A research question should be clear, specific, and concise.
Below are the research questions that this study is going to address.
i. What is the effectiveness of isolation forests in anomaly detection across various
domains on websites?
ii. What is the performance capacity of isolation forest in anomalies detection within
website-related datasets, and how does its performance compare with other
techniques of detecting anomalies
iii. In what ways does the isolation forest lead to website performance optimization
through the identification of impactful factors like server load and page load
times?
iv. What are the key parameters and configurations of the Isolation Forest algorithm
that significantly influence its anomaly detection performance in the context of
websites?
Technical Work Undertaken as Part of The Investigation
In every study, technical work ensures that the right insights are derived. Some of
the technical work include data collection and construction, implementation of
algorithms, and literature reviews from primary and secondary sources. To address this
research question, data will be collected and structured from several sources, like
websites and servers. The collected data include HTTP traffic logs and server resource
3
utilization data. The traffic logs in this study are essential since they help identify
unknown logs which might lead to attacks. The HTTP traffic logs play a crucial role in
capturing the details of the interaction between web users and servers, including
requests for web pages and other HTTP activities. Analysis of the HTTP logs gives a
wide range of resourceful information in this study, including behavioral pattern analysis,
identification of unusual access patterns and resource utilization anomalies, and user
experience disruptions.
Behavior Pattern Analysis
Behavioral Pattern analysis in HTTP traffic logs is one of the investigative
activities that is happening, whereby traffic logs identify the behaviors and interactions
of different users with websites. By examining the frequency and the sequence of this
interaction, it becomes easy to establish the baseline behavior of users and thus identify
the activities that might lead to anomalous activities. Anomalies in the HTTP traffic can
also play a significant role in identifying suspicious and unauthorized access attempts
on websites, and this is why it is one of the activities that this study is undertaking as
part of the investigations. By monitoring the HTTP traffic logs, the isolation forest can
identify unusual patterns like multiple failed login attempts from a single Ip address or a
spike in traffic from an unfamiliar geographical location. HTTP traffic logs also provide
real-time monitoring, and thus, in case of unusual behavior, it is easy to detect it. This
enables the isolation forest algorithm to detect the anomalies as they happen, thus
enabling prompt responses.
Dataset Construction
Dataset Construction is among the technical work that is undertaken in this study.
Several steps are followed in this activity, such as data collection, which entails
collecting server logs, and HTTP traffic logs from credible websites. The next step in
constructing datasets is data preprocessing which includes cleaning the data to ensure
that only the required data is obtained (Alkofahi et al., 2022). Preprocessing the dataset
is one of the most valuable steps in model creation since it removes data duplicates,
handles the missing values, and transforms the data into the correct format. As part of
the data construction activities, there is also future engineering whereby meaningful
features are derived from raw data that captures the website's behaviors.
Isolation Forest Implementation
Isolation forest implementation is also among the technical activity being
performed in this study. The isolation forest algorithm has been proven to be one of the
most effective mechanisms for detecting anomalies, and it offers a solution for
addressing critical challenges associated with identifying unusual instances (Carletti et
al., 2023). The isolation forest is implemented using Python and relevant libraries like
scikit learn. This study prefers Python as the best suitable programming language
because it offers a wide range of rich ecosystems of libraries like scikit-learn, NumPy,
pandas, and MATLAB, which are vital in modeling and data visualization. Python is also
essential in machine learning and anomaly detection, which is another reason why it is
used in this study. The implementation of isolation forest will consist of customization
4
and parameter tuning to align the algorithm with the unique characteristics of website
data.
Ground Truth and Anomaly Labelling
Ground Truth and Anomaly labeling are also among the technical work
undertaken as part of the investigative procedures. Anomaly labeling provides
meaningful components of investigation of anomaly detection with isolation forest.
Various steps are involved in categorizing instances to determine whether the datasets
are normal or anomalous, including anomaly labeling and establishing ground truth. The
establishment of Ground Truth refers to the definitive categorization of instances in the
dataset as either normal or anomalous. It serves as the reference against which the
performance of the Isolation Forest algorithm is evaluated. The ground truth is crucial
for calculating metrics such as precision, recall, and the F1-score, which quantify the
algorithm's accuracy in identifying anomalies. Establishing ground truth requires
meticulous analysis and manual labeling of a representative subset of data instances.
These labeled instances become the benchmark against which the algorithm's
predictions are compared.
Comparative Analysis
Comparative analysis approach involves the assessment of isolation forest and
other algorithms' limitations, their performance, and their capacities in detecting
anomalies in websites. There are vital steps that this study follows while performing
comparative analysis, which include a selection of the baseline methods. This involves
the identification of the set of baseline methods that are used in detecting anomalies in
websites. The baseline methods include the traditional statistical approaches, other
machine learning, and rule-based systems used for anomaly detection. Feature
extraction is also a critical step in comparative analysis. The relevant features are
extracted from websites to ensure that the represented data only identifies the website
activities and potential anomalies.
Tools That Are Used in The Investigation, Experimentation, and The Evaluation
Some of the tools used for investigation include Python programming language,
which offers a broad range of libraries for visualization, data analysis, and machine
learning. Jupiter Notepad will also be used as part of the investigation tools. Scikit-learn,
NumPy and Pandas, MATLAB, and Seaborn are the tools used for experimentation
(Rajamani et al., 2023). Statistical analysis tools like Scipy and performance metrics
libraries will be used for evaluation. Additional tools will include Text Editors or IDEs:
Tools like Visual Studio Code, PyCharm, or Jupiter Lab for writing, editing, and running
your code. Document Preparation Tools involved include LaTeX or Microsoft Word for
creating documentation, reports, and presentation.
Deliverables intended to be produced in the project
Design Document: A detailed design document outlining the project's scope,
objectives, methodology, and technical specifications.
5
Datasets: Structured and preprocessed datasets containing website-related
attributes for experimentation and evaluation.
Isolation Forest Implementation: A functional implementation of the Isolation
Forest algorithm tailored to website anomaly detection.
Anomaly Detection Evaluation Results: Comprehensive evaluation results,
including precision, recall, F1-score, ROC curves, and comparative analysis with
other methods.
Experimental Design: Documentation of the experimental setup, including data
partitioning, parameter tuning, and validation strategies.
Final Report: A comprehensive report summarizing the research question,
methodology, findings, conclusions, and potential future directions.
Test Plans: Test plans outlining the procedures for validating the algorithm's
functionality and performance.
Section 2: Progress to Date
There are various activities that I have performed to date in this project. One of
them is data collection from various sources, which will be used in the dataset of our
focus scenario. To date, I have gathered information from various datasets from credible
data sources like GitHub and Kaggle, which are vital in this study. The data gathered
include traffic logs, server logs, and user interaction logs, which help provide insights
about anomalies. The raw data is preprocessed to remove duplicates, sometimes
leading to compromised insights and, thus, the wrong conclusions. I am also in the
process of implementing the isolation algorithm.
Challenges And Their Anticipated Solutions
Real-Time Data Simulation
Real-time data simulation is one of the challenges experienced in this study in
investigating anomaly detection using the isolation forest algorithm. Simulating data
streams that precisely mimic the time-sensitive nature and the dynamic of real HTTP
traffic patterns is very complex. Monitoring the HTTP patterns requires one to have
more complex and specialized techniques (Zhao). Behavioral patterns also pose a
considerable challenge to real-time data simulation in websites since websites can
display a wide range of behaviors depending on the time, the users of the websites, and
the content popularity. Simulating these anomalies patterns is complex and requires the
generation of data that mirrors these behaviors. Real HTTP traffic exhibits temporal
dependencies, where the order and timing of requests matter. Capturing these
dependencies accurately in simulated data streams is challenging. For instance, user
sessions, navigation patterns, and interactions with dynamic content all contribute to the
intricate temporal nature of web traffic.
Class Imbalance
6
Class imbalance is a huge problem in investigating anomaly detection using the
isolation forest algorithm in websites (Muneer et al., 2022). When progressing with this
study, I realized there is a conflict between two classes, anomalies, and normal classes.
Class imbalances occur while normal instances, or rather the normal classes,
outnumber the anomalies classes. This imbalance can impact the algorithm's ability to
detect anomalies accurately and lead to biased results. Class imbalance can lead to
issues such as reduced sensitivity to anomalies, decreased precision, and biased model
performance metrics. In anomaly detection, the algorithm may focus on the majority
class (normal instances) and overlook anomalies, resulting in false negatives and
compromised security or performance optimization
Anticipated Solutions
Several strategies need to be actualized to address the issue of class imbalance.
One of the solutions to class imbalance is synthetic data generation, whereby one
generates synthetic anomalies to augment the minority class, thus leading to a more
balanced dataset. Synthetic data is generated using Synthetic Minority Over-Sampling
Technique. The other solution to an imbalanced class is the adjustment of algorithm
parameters which affects the sensitivity of the minority class, which is the anomaly
instances. Adjustments to the sampling techniques will also solve the issue (Yang et al.,
2022). Explore sampling techniques to balance the class distribution. Oversampling the
minority class (anomalies) or undersampling the majority class (normal instances) can
help create a more balanced dataset.
Real-Time data simulation can also be solved using synthetic data generation
whereby a researcher Implements sophisticated synthetic data generation techniques
that replicate temporal dependencies and behavioral patterns (Zhou et al., 2022). These
techniques may involve Markov models, generative adversarial networks (GANs), or
recurrent neural networks (RNNs) trained on historical data.
Data Augmentation also solves the problem of real data simulation whereby a
researcher Augments real historical data with synthetic anomalies and patterns to
create a hybrid dataset that represents real and simulated behaviors (Bayer et al.,
2022). This approach requires careful calibration to ensure that the synthetic anomalies
align with actual anomalies. Dynamic parameterization is also an anticipated solution to
real-time data simulation. Developing a simulation framework that allows dynamic
parameterization, enabling adjustments to traffic patterns, user behaviors, and anomaly
injection rates, will solve the challenge of real-time data simulation. This framework
could mimic website updates and user interactions over time.
Conducting an in-depth review of existing literature on real-time data simulation
techniques, focusing on approaches tailored to web traffic, will give one a good baseline
for solving the issue. Consulting the experts and collaborating with them will also give
one an idea of how the problems addressed above will be solved. Collaborating with
experts in time-series analysis and data simulation will allow a researcher to explore
7
potential solutions, thus enabling them to gain the best insights. Validating the quality
and accuracy of the simulated data streams by comparing them against historical data
and real-time website traffic monitoring will also solve the challenges mentioned.
Section 3 Planned Work
1. Problem Definition and Scope (Completed):
Description: This task means defining the research problem, goals, and project scope.
Deliverables: Problem statement, research questions, and project scope.
Quality Evaluation: Clarity of problem definition and alignment with research objectives.
2. Literature Review and Background Research (Completed):
Description: Review relevant literature on anomaly detection, Isolation Forest algorithm,
website behaviors, and related methodologies.
Deliverables: The key deliverables of the background research and literature review is a
document summarizing key findings and insights.
Quality Evaluation: To evaluate the quality of the background research and literature
review, the thoroughness of literature coverage and identifying gaps need to be
determined.
3. Data Collection and Preprocessing (In Progress):
Data collection and preprocessing means collecting diverse website-related data
sources and preprocessing them by cleaning, structuring, and extracting relevant
features.
Deliverables: Preprocessed dataset ready for analysis.
Quality Evaluation: Data completeness, accuracy, and representativeness.
4. Isolation Forest Implementation and Customization (In Progress, Will take one
month)
Description: Isolation Forest implementation and customization entail Implementing the
Isolation Forest algorithm using Python and customizing it to website anomaly detection
requirements.
Deliverables: Functional Isolation Forest implementation with configurable parameters.
Quality Evaluation: Correct implementation and customization to domain needs.
5. Anomaly Labeling and Ground Truth (Completed):
Description: Manually label a subset of data instances as normal or anomalous to
establish ground truth.
8
Deliverables: Labeled dataset serving as ground truth for evaluation.
Quality Evaluation: Consistency and accuracy of anomaly labeling.
6. Real-Time Data Simulation Techniques (Ongoing one month):
Description: Explore and implement techniques to simulate real-time website traffic
data.
Deliverables: Simulated data streams that replicate temporal and behavioral
characteristics.
Quality Evaluation: Realism of simulated data compared to historical patterns.
7. Comparative Analysis with Baseline Methods (Upcoming, Target completion
one month):
Description: This will entail applying the Isolation Forest algorithm and baseline
methods to the dataset, evaluating their performance using various metrics, and
conducting a comparative analysis.
Deliverables: Evaluation results, comparative analysis report.
Quality Evaluation: Rigorous comparison, statistical significance analysis.
8. Experimentation and Evaluation (Upcoming, Target Completion: Two months):
Description: Evaluate the Isolation Forest algorithm's performance in detecting
anomalies, optimizing website performance, and enhancing security.
Deliverables: Performance metrics, visualization of results.
Quality Evaluation: Accuracy, precision, recall, and ability to distinguish anomalies.
Evaluation and Quality Assessment
Algorithm Performance: The quality of the project work will be assessed based on the
Isolation Forest algorithm's performance metrics, including precision, recall, F1-score,
and ROC curves—the algorithm's ability to detect anomalies and contribute to website
security accurately.
9
Bibliography
Alkofahi, H., Umphress, D. and Alawneh, H., 2022, June. Preparing HTTP traffic for
process mining. InC2022 13th International Conference on Information and
Communication Systems (ICICS)C(pp. 142-148). IEEE
Ansari, M.F., Sharma, P.K. and Dash, B., 2022. Prevention of phishing attacks using AI-
based Cybersecurity Awareness Training.CPrevention
Bayer, M., Kaufhold, M.A. and Reuter, C., 2022. A survey on data augmentation for text
classification.CACM Computing Surveys,C55(7), pp.1-39.
Carletti, M., Terzi, M. and Susto, G.A., 2023. Interpretable anomaly detection with diffi:
Depth-based feature importance of isolation forest.CEngineering Applications of
Artificial Intelligence,C119, p.105730.
Muneer, A., Taib, S.M., Fati, S.M., Balogun, A.O. and Aziz, I.A., 2022. A Hybrid Deep
Learning-Based Unsupervised Anomaly Detection in High Dimensional
Data.CComputers, Materials & Continua,C70(3)
Rajamani, S.K. and Iyer, R.S., 2023. Machine Learning-Based Mobile Applications
Using Python and Scikit-Learn. InCDesigning and Developing Innovative Mobile
ApplicationsC(pp. 282-306). IGI Global.
Yang, F., Wang, K., Sun, L., Zhai, M., Song, J. and Wang, H., 2022. A hybrid sampling
algorithm combining synthetic minority over-sampling technique and edited
nearest neighbor for missed abortion diagnosis.CBMC Medical Informatics and
Decision Making,C22(1), p.344
Zhao, J., Zhuo, F., Sun, Q., Li, Q., Hua, Y. and Zhao, J., Tensor Compressed
Transformer Network for Traffic Flow Forecasting.CAvailable at SSRN 4502093.
Zhou, S., Lu, Y., Bao, D., Wang, K., Shan, J. and Hou, Z., 2022. Real-time data-driven
fault diagnosis of proton exchange membrane fuel cell system based on binary
encoding convolutional neural network.CInternational Journal of Hydrogen
Energy,C47(20), pp.10976-10989.
10
Appendices
Appendix 1
Isolation forest code
11
Appendix 2 : Literature Review From Credible Websites
