Article Per Year (5 Year)
p-Index From 2021 - 2026
0.339
P-Index
This Author published in this journals
All Journal TELKOMNIKA (Telecommunication Computing Electronics and Control)
Victor Mathebula
North-West University
Computer Science & IT

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
Real-time anomaly detection system using best performed machine learning model Victor Mathebula; Bukohwo Michael Esiefarienrhe
TELKOMNIKA (Telecommunication Computing Electronics and Control) Vol 24, No 4: August 2026
Publisher : Universitas Ahmad Dahlan

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.12928/telkomnika.v24i4.27561

Abstract

Effective anomaly detection is critical for protecting organizational networks against increasingly sophisticated cyber threats. However, most machine learning-based intrusion detection models are developed and validated using public benchmark datasets, which may not reflect the operational characteristics, traffic behavior, and threat patterns of real institutional networks. In the case of Umalusi, there is currently no anomaly detection model customized and validated using Umalusi-specific network traffic, creating a practical gap in deployable cybersecurity capability. This study proposes a hybrid machine learning framework tailored to support accurate, efficient, and operationally relevant anomaly detection. Using knowledge discovery in databases (KDD) process, network traffic data were collected and pre-processed through normalization, label encoding, missing value treatment, and dimensionality reduction using principal component analysis (PCA). The 16 hybrid models integrating unsupervised anomaly detection with supervised classification were implemented and comparatively evaluated. Experimental findings indicate that the density-based spatial clustering of applications databasescan (DBSCAN) + random forest (RF) model achieved 99.92% accuracy while maintaining a low false positive (FP) cost, making it suitable for a security operations centre (SOC). In addition, a Flask-based web application was developed to enable real-time deployment by sniffing live network traffic, executing inference, and persisting results in an SQLite database.
Co-Authors Bukohwo Michael Esiefarienrhe