Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{193486,
        author = {Kalaivani M and Muhammad Ashiq H and Dr.T.Ramaprabha},
        title = {Endpoint Command Execution Monitoring and Alerting Tool Machine Learning-Based Network Anomaly Detector},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {10},
        pages = {1302-1308},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=193486},
        abstract = {The increasing sophistication of cyber threats has made traditional signature-based security mechanisms insufficient for protecting modern enterprise environments. Attackers frequently exploit endpoint systems through unauthorized command execution, privilege escalation, and lateral movement, while simultaneously launching network-based attacks such as data exfiltration, distributed denial-of-service (DDoS), and advanced persistent threats (APTs). To address these challenges, this paper proposes an integrated Endpoint Command Execution Monitoring and Alerting Tool combined with a Machine Learning-Based Network Anomaly Detector. The endpoint monitoring component continuously tracks command-line activities, user privileges, process hierarchies, and execution patterns to detect suspicious behavior in real time. Simultaneously, the network anomaly detection module analyzes traffic flow characteristics using machine learning algorithms to identify abnormal patterns indicative of cyberattacks. The system employs supervised and unsupervised learning techniques, including Random Forest, Support Vector Machine (SVM), Isolation Forest, and LSTM models for sequential pattern recognition. Feature engineering incorporates command frequency analysis, abnormal execution timing, packet size variations, protocol usage anomalies, and authentication irregularities. Experimental evaluation demonstrates high detection accuracy, low false positive rates, and near real-time alert generation. The integrated framework enhances threat visibility, improves zero-day attack detection, and reduces the operational burden on security teams. The proposed solution offers a scalable, adaptive, and intelligent cybersecurity defense mechanism suitable for enterprise networks, government institutions, and critical infrastructure environments.},
        keywords = {Endpoint Security, Network Anomaly Detection, Machine Learning, Cybersecurity, Intrusion Detection System (IDS).},
        month = {March},
        }