Cybersecurity / Python · Scikit-learn
ML-based intrusion detection
An Isolation Forest learns a baseline from synthetic network windows. Move the alert threshold and see what it catches or misses.
Model output
Threshold explorer
The Scikit-learn model is already trained. Changing this cutoff changes the review queue, without retraining it.
Higher scores mean less like the baseline. They are not attack probabilities.
Example windows
window-0805Flagged for reviewSynthetic port probe
- Connections
- 170
- Destination ports
- 62
- Destination hosts
- 1
- Mean bytes sent
- 51
- Failed logins
- 1
Anomaly score 0.6596 > 0.6014 cutoff
This generated attack scenario enters the review queue. The scenario label was withheld from the model.
600 training windows · 200 calibration windows · 200 held-out windows. All records are generated. Scores come from the downloadable Python project.
Implementation notes
The baseline decides what looks unusual
Isolation Forest fits 600 benign training windows. A separate set of 200 windows sets the cutoff before the model sees the holdout. Scenario labels stay out of the features.
A benign backup can look unusual when Scikit-learn has never seen that traffic pattern. Low-rate probes can blend into routine traffic. Both cases are included in the fixture.
The Python example starts with aggregated flow data. Failed-login counts require an authentication-log join. Anomaly scores alone cannot establish zero-day detection.
Scikit-learn: IsolationForestRun locally
Source and example data
The Python project includes the example inputs and tests. Open its README for prerequisites and the complete workflow.
Download project sourcepython -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
python generate_fixture.py
python ids.py train
python ids.py evaluate