Anomaly-Based Network Intrusion Detection Using Isolation Forest on the Imbalanced UNSW-NB15 Dataset - Syifaurachman Syifaurachman; Samso Supriyatna; Muhamad Ihsan Ashari (Politeknik Harapan Bersama, 2026)
The increasing complexity of network traffic and the rapid evolution of cyber threats require adaptive intrusion detection systems capable of identifying anomalous behavior in large-scale network environments. Traditional signature-based detection methods are effective in recognizing known attack patterns but are limited in detecting emerging or zero-day threats. Consequently, anomaly-based approaches using machine learning have become an important research direction in modern intrusion detection systems. One of the widely used unsupervised algorithms for anomaly detection is Isolation Forest, which identifies anomalies by isolating observations through random partitioning mechanisms.This study investigates the capability of the Isolation Forest algorithm for intrusion detection using the UNSW-NB15 dataset under imbalanced data conditions. The dataset consists of 2,540,044 network traffic records with approximately 87% normal traffic and 13% attack traffic. A quantitative experimental approach was applied, including data preprocessing, model development using Isolation Forest, and performance measurement using several evaluation metrics, namely Accuracy, Precision, Recall, F1-score, Receiver Operating Characteristic Area Under the Curve (ROC-AUC), and Precision-Recall Area Under the Curve (PR-AUC).The experimental results show that the model achieved an overall accuracy of 79.3% and a ROC-AUC value of 0.6302, indicating moderate capability in distinguishing between normal and malicious traffic. However, the PR-AUC value of 0.1710 reveals limited sensitivity in detecting minority attack instances under highly imbalanced conditions. These findings highlight that evaluation of intrusion detection systems under imbalanced data should not rely solely on accuracy-based metrics. Isolation Forest can serve as a baseline anomaly detection mechanism, but additional strategies are required to improve detection sensitivity in real-world intrusion detection environments.