Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{198359,
        author = {Nadinti Nagoor Vali and Munagala Rajeswari and Muchalapuri Sai Teja},
        title = {Abnormal Detection in Network Traffic based on Machine Learning Methodologies},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {11},
        pages = {8468-8474},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=198359},
        abstract = {Internet tech grows fast, so does danger from online attacks. Because companies need safe connections to share info, protection matters a lot. Older threat scanners work by spotting familiar signs, yet they miss anything unfamiliar. New risks slip through easily - that is why finding odd behaviors draws serious attention now.
What shows up out of place in network flow often breaks typical usage trends. Odd behaviors might point to digital dangers like flood assaults, scanning intrusions, or login breaches. Instead of fixed checklists, smart systems now catch oddities by studying tons of activity records on their own. Learning from real examples helps them spot red flags hidden within regular operations.
This project explores how machines can spot odd patterns in web activity using smart software tricks. Instead of relying on one method, it tests multiple ways to see what works best. One popular collection of internet data helps check if these tools catch strange actions correctly. Outliers pop up when something feels off compared to normal flow. Among those tested, some guess better than others by noticing hidden clues. Each technique handles signals differently - some pay attention to rare events while others weigh frequent signs more heavily. Results show not every model sees threats the same way. What slips past one might get caught by another. Performance shifts depending on how messy or clean the information appears. Spotting trouble early depends less on complexity and more on fit. Some respond quickly; others need time to adjust before catching subtle changes. How they learn matters just as much as what they find.
Missing pieces get filled first. Then duplicates vanish one by one. Categorical items turn into numbers next. Numerical inputs shrink down to a common scale after that. Features thin out through smart filtering along the way. Models learn only once the data settles. Effectiveness shows up in scores like accuracy and precision later. Recall joins F1-score to confirm results stand firm. Each metric tells part of the story during checks.
Outcomes from tests show XG Boost and Light GBM outper- form many alternatives when it comes to prediction accuracy. Because they handle messy, real-world data well, spotting odd behavior in network flows becomes more reliable. When patterns shift over time, these methods adapt without constant reworking by hand. Instead of relying on rigid rules, the approach learns from examples - making detection sharper. Even with noisy inputs, useful signals emerge through repeated modeling steps. One big plus? It works across different kinds of networks without major tweaks. As attacks evolve, so does its ability to tell normal from suspicious. Behind the scenes, decision layers stack up like filters catching subtle clues. Not every model manages this balance between speed and precision - but these do. So, when traffic speeds increase, response times stay low. Detection isn’t perfect, yet improvement trends point upward steadily. For now, leaning on smart grouping beats going solo with one algorithm.},
        keywords = {Network Security, Anomaly Detection, Machine Learning, Intrusion Detection System, KDDCup99 Dataset},
        month = {April},
        }