Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{207067,
        author = {Haleema Sadiya Badami},
        title = {Machine Learning-Based Anomaly Detection Framework for Modern Network},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {13},
        number = {2},
        pages = {4561-4567},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=207067},
        abstract = {The rapid expansion of networked systems and the growing sophistication of cyberattacks have made traditional signature-based security mechanisms insufficient for protecting modern computer networks. This paper presents a Machine Learning-Based Anomaly Detection Framework for Network Intrusion Detection Systems (NIDS) that classifies network traffic as either normal or malicious, and further identifies the specific category of attack. The proposed framework is built and evaluated on the NSL-KDD benchmark dataset, an improved and de-duplicated version of the original KDD Cup 1999 dataset that eliminates redundant records responsible for biased evaluation in earlier intrusion detection research. The methodology follows a structured pipeline consisting of data preprocessing, optional feature reduction, feature normalization, machine learning model selection, model training, model testing, and result evaluation. Network connection records are analyzed using both basic connection-level attributes (protocol type, service, flag, duration) and derived traffic and host-based statistical features (count, srv_count, serror_rate, dst_host_count, dst_host_srv_count) to detect four major attack categories, namely Denial of Service (DoS), Probing (Probe), Remote-to-Local (R2L), and User-to-Root (U2R), in addition to normal traffic. The trained model was serialized and deployed as an interactive Flask-based web application, allowing real-time classification of network connection records through a browser-based interface. Experimental evaluation demonstrates that the framework is capable of correctly identifying the underlying attack class, as illustrated through representative Probe and DoS classification instances captured from the deployed system. The results confirm that machine learning-based anomaly detection provides an adaptive, data-driven alternative to static rule-based intrusion detection systems and is capable of identifying previously unseen attack patterns.},
        keywords = {Network Intrusion Detection System (NIDS); Anomaly Detection; Machine Learning; NSL-KDD Dataset; Network Security; Denial of Service (DoS)},
        month = {July},
        }