<![CDATA[ Modern cyber threats require adaptive intrusion detection systems (IDS) capable of identifying complex anomalies within large networks. . Traditional signature-based methods frequently struggle to detect novel zero-day attacks, making unsupervised machine learning, specifically Isolation Forest (IF), a vital research direction. IF detects anomalies by isolating unusual observations through random partitioning mechanisms.. This study evaluates IF for intrusion detection using the highly imbalanced UNSW-NB15 dataset, comprising 2,540,044 records (87% normal traffic, 13% attack traffic). A quantitative approach was applied, evaluating performance across Accuracy, Precision, Recall, F1-score, ROC-AUC, and PR-AUC. Results show an accuracy of 79.3% and a ROC-AUC of 0.6302. However, a low PR-AUC (0.1710) and F1-score (0.18) reveal the model's critical failure in detecting the minority attack class due to severe feature overlap. These findings prove that relying strictly on Accuracy or ROC-AUC is misleading in imbalanced scenarios. Therefore, IF should serve only as a lightweight baseline screening layer; hybrid architectures are necessary to improve detection sensitivity in real-world IDS.]]>
Copyrights © 2026
