2024 International Conference on Circuit Power and Computing Technologies (ICCPCT)

Enhancing Cybersecurity with Machine Learning:

Evaluating the Efficacy of Isolation Forests and
Autoencoders in Anomaly Detection
Rishabh Sharma Madhur Grover
Centre for Research Impact & Outcome, Chitkara Centre for Research and Development,
2024 7th International Conference on Circuit Power and Computing Technologies (ICCPCT) | 979-8-3503-7281-6/24/$31.00 ©2024 IEEE | DOI: 10.1109/ICCPCT61902.2024.10673338

Chitkara University Institute of Engineering and Technology, Chitkara University, Himachal Pradesh,174103, India
Chitkara University, Rajpura-140401 Punjab, India [Link]@[Link]
[Link]@[Link]

Abstract— The growing intensity of cyber threats requires Autoencoders, as two powerful tools that identify unusual
security systems with high intellectual capabilities that are patterns and handle them as cyber threats or breaches [4]. A
dynamically adapting to new challenges. This study explores mainline of machine learning, namely anomaly detection,
the utilization of Isolation Forests and Autoencoders in means finding behavioral patterns in data that deviate from
machine learning for anomaly detection. It is for their the norm. These irregular models primarily draw attention to
contribution to cybersecurity to boost it. In this research, an the large and in most cases serious, dangerous cases such as
extensive dataset of network traffic that manifests both normal breaches, attacks, network penetration, and data privacy
and malicious instances is used to examine the efficacy of these violations [5]. The main motivation for the implementation
models in detecting anomalous events that may constitute of anomaly detection in cybersecurity is that abnormal
cyber threats. The approach applied involves data collection, activities represent distinct data patterns against genuine
preprocessing, the thorough evaluation of the models against activities. Machine learning algorithms now give the
metrics such as Anomaly Detection Rate (ADR), Mean Time to possibility to do this more quickly and accurately. In
Detect (MTTD), False Alarm Rate (FAR), and Detection addition, irregularities are also detected
Consistency (DC) Output shown that applying Isolation Forest
automatically. Isolation Forest (an ensemble of anomaly
detection methods) works by isolating anomalies rather than
has found 85% anomalous record, with a time to detect of 2
basing their results on profiling normal data points
seconds and a consistency of 90%, while Autoencoder got
[6]. However, this characteristic is uniquely implemented by
slightly lower detecting rate but beats off false alarm by
randomly selecting some feature and then picking up a value
finding only 4%. Unlike traditional methods done by Support
that lies between the minimum and maximum values of this
Vector Machines and Decision Trees where this model not only
feature. This method is especially useful when there are
was successful but in some cases performed better, it validated numerous dimensions of data involved, such as in network
their implementation ability and usefulness in the traffic data, and as a result, it enables immediate detection of
cybersecurity real world. The research presents a major abnormalities [7]. Consequently, many scientists have used
activity of applying Isolation Forests and Autoencoders to autoencoders as a way to learn a compact representation of
cybersecurity systems which elevate their anomaly detection unlabeled data. In doing so, Autoencoders can filter and then
potency. This also explains the importance of combining it with reconstruct network traffic data, the outputs of which are
other machine learning models within the existing security expected to be similar to the original input data. Anomalies
systems, for the ability to boost the accuracy in detection and occurring are identified by comparing the reconstructing
decrease response time to threats. Therefore, this study is one error; the greater the error, the higher the possibility that the
of the crucial pieces in the building of systems that are data point is an anomaly [8]. This detection strategy is
adaptable and resilient to attacks that continue to be more therefore good at detecting not just the simple and larger
unpredictable. pattern deviations but also the more intricate and elusive
Keywords— Cybersecurity, Machine Learning, Anomaly irregularities. As these insightful machine learning methods
Detection, Isolation Forest, Autoencoder, Network Traffic are deployed in cybersecurity, perhaps not only does the
Analysis, Threat Detection, Cyber Defense. detection speed and effectiveness improve, but this also
reduces the time to detect and respond to potential threats,
I. INTRODUCTION thereby increasing overall safety [5]. The goal of this paper
The cyber security landscape is constantly changing and its will be to show that Isolation Forests and Autoencoders are
development requires the innovation of more advanced practical ways in which cybersecurity can be explored,
defense mechanisms to deal with the complex cyber threats sharing both their strengths and weaknesses. In the
[1]. Traditional security measures, though essential, proved succeeding parts, the theoretical background of anomaly
to be completely inadequate against the new generation of detection, Isolation Forests, and Autoencoders will be
multi-purposed and complex cyber assaults, thus allowing elaborated, and the possibilities of their practical usage in
private and public networks to remain very vulnerable cases with real data will be discussed as well [2]. This
[2]. The inclusion of ML in cybersecurity strategies as an journey will demonstrate how machine learning has
emerging area in the security field can be viewed as a empowered the cybersecurity industry by enhancing the
positive avenue that can be explored to make cyber systems viability of our digital platforms.
more secure [3]. This paper studies the use of anomaly
detection algorithms, for instance, Isolation Forests and

979-8-3503-7281-6/24/$31.00 ©2024 IEEE

1017
Authorized licensed use limited to: Zhejiang University. Downloaded on August 05,2025 at 16:32:01 UTC from IEEE Xplore. Restrictions apply.
 2024 International Conference on Circuit Power and Computing Technologies (ICCPCT)

II. LITERATURE REVIEW effective in practical scenarios. In this article, we take the
Machine learning literature concerning defending against existing knowledge base as a point of departure with a focus
cyber attacks through particle and elemental applications is on offering further evidence on how machine learning is
huge and varied, which focuses on the application of various instrumental in elevating the cybersecurity landscape.
algorithms for the identification and counteracting of cyber
threats [1]. One may speak about anomaly detection among III. METHODOLOGY
the most important areas where machine learning, in This research paper implements a detailed methodology to
contrast to conventional methods, may prove to be measure the consistency of Isolated Forests and
enormously helpful due to the reason that machines learn Autoencoders in identifying cybersecurity threats through
and adapt from the data [2]. Machine Learning's patterns anomaly detection. The methodology is structured into
and anomaly-detecting capability without explicit several key phases: data acquisition, data preparation, model
programming directions are among the key reasons this training, and model evaluation [9]. Every phase of the study
technology is pivotal in fighting cyber threats [4]. Many is of fundamental importance for guaranteeing the
researchers have conducted various experiments with credibility and accuracy of it. This work utilizes a broad
anomaly detection techniques based on machine learning dataset, overall network traffic data, which consists both of
where a substantial part of the effort was focused on benign and malicious traffic patterns. The details have been
unsupervised learning as these approaches don’t use the demonstrated in Table I. This dataset is the result of the
predefined labels that are unavailable in new and unknown combination of many cybersecurity databases to make sure
situations [6]. Among the different methods, Isolation the database has a robust sample that covers a wide
Forests are highly recognized for their speed and scalability spectrum of normal activities and attack channels. The data
performance and these are the critical factors for dealing need to be prepared for a thought-out modeling process [10].
with the wide range and high dimensions of data that are There are several preprocessing steps for this.
characteristically associated with network traffic [3]. This
method applies available resources more efficiently because TABLE I. DATASET METRIC
it can separate the few outliers from the many, which leads Metric Description Value
to the fast identification of the vertices that allow easy Total Total number of data 100,000
determination of where the normal points lie [7]. The Instances points in the dataset.
accuracy of the approach matches the unpredictability of Number of Total number of 30
Features attributes per instance.
cyber threats. However, Autoencoders are very well
Benign Several normal data 90,000
understood because they can reconstruct input data as well Instances points are labeled as
as learn to detect errors by the discrepancy in the non-anomalous.
reconstruction [8]. The program has illustrated some of the Malicious Number of data points 10,000
harm in the heavily noisy data services, but it is challenging Instances labeled as anomalies
to find the differences. The convincing feature of (threats).
Autoencoders is their flexibility to generate deep learning Percentage Proportion of 10%
models that can detect unique and complicated non-linear of anomalous instances in
patterns with these kinds of attacks [7]. What is notable is Anomalies the dataset.
that the implementation of these machine learning methods Dataset Origin(s) of the data Mixed sources
into cyber operations also gives rise to several practical Sources collection. including
simulated and real-
issues like synthetic spam and the need to train on new data world network
to embrace perpetual cyber vulnerabilities [1]. On the other traffic data
hand, it has also been shown that machine learning Data The period over which Jan 2023 - March
algorithms show differing success rates in cybersecurity Collection the data was collected. 2023
contexts: proving there is no one silver bullet and making it Period
obvious that the environment is deciding the suitable tool Missing Information on any Minimal, less than
[6]. The literature further discusses the use of multiple Data missing values in the 0.5% of total data
machine learning techniques that combine with the dataset. points
reference to enhance the rate of detection and Data The ratio of benign to 9:1
reliability. One of the different ways to improve the general Imbalance malicious instances.
Ratio
effectiveness of cybersecurity measures can be the synergy
Feature Types of features (e.g., Mostly continuous
of different sizes of algorithms which includes, for instance, Type continuous, with some
detecting anomalies fast and identifying the patterns by categorical). categorical (e.g.,
combining the fast anomaly detection of Isolation Forests protocol type, port
and the detailed pattern recognition of Autoencoders [7]. number)
Finally, the literature has built a solid basis for the use of
machine learning in the field of cybersecurity, according to Normalization: Numeric features are scaled to correspond
advancements made by anomaly detection. It offers a rich with this standard range, in order not to have any attribute's
kit of methods, concepts, and statistical evidence that can influence on the model to be based on scale differences [11].
serve for developed algorithms such as Isolation Forests and Noise Reduction: Techniques such as a rolling average and
Autoencoders [8]. Nonetheless, these points give the basis filtering smooth out random fluctuations that the algorithm
for work that probes deeper into the complex lives and the
exact integrations needed for the tools mentioned to be

1018
Authorized licensed use limited to: Zhejiang University. Downloaded on August 05,2025 at 16:32:01 UTC from IEEE Xplore. Restrictions apply.
 2024 International Conference on Circuit Power and Computing Technologies (ICCPCT)

may learn from and lead the learning algorithm in the wrong False Alarm Rate (FAR): The high-incident amount of
direction [12]. normal objects that is under-detected as an anomaly.
Feature Selection: Analyze to pick out the most important Detection Consistency (DC): Engages the consistency of
characteristics of an anomaly. This is where methods of Deviation design across the different foreins within the test
Principal Component Analysis (PCA) come into play to data set.
achieve this by reducing dimension while retaining IV. RESULTS AND DISCUSSIONS
important information [13]. The performance of Isolation Forest and Autoencoder
Model Implementation: Our process involves involving models in detecting cybersecurity anomalies is huge and
two specific structures having different configurations. these are considered in testing their effectiveness with the
Isolation Forest Implementation: described dataset. The evaluation focused on several
Parameters: Adjustments include the number of trees, the performance metrics: The four essential metrics used for the
sample size, and the mode of isolation which were fine- assessment of the system efficiency are: ADR (Anomaly
tuned by observations in the first trials [12]. Detection Rate), MTTD (Mean Time to Detect), FAR (False
Training: The model caters to the preprocessed data of a Alarm Rate), and DC (Detection Consistency). The
given amount of the data to create an effective anomaly outcomes present the pros and cons of each model and they
identification based on the forest path length [14]. provide an insight into them with the latest or best
Autoencoder Implementation: techniques in the industry in the field of anomaly detection.
Architecture: The suggested model has a configuration Table II below presents the performance of two models.
comprising of an input layer correlating with the count of
selected features, one or more hidden layers, and an output TABLE II. MODELS PERFORMANCE
layer that replicates the previous input. The complete Model Anomaly Mean False Detection
architecture of the model is shown in Figure 1. Detection Time Alarm Consistency
Rate to Rate
Detect
Isolation 85% 2 5% 90%
Forest seconds
Autoencoder 80% 3 4% 85%
seconds

The Isolation Forest model showed simply better ADR and

DC, which could mean that it is a little bit more accurate
than other methods when we need quick detection of an
anomaly in this data set. Nevertheless, simpler Autoencoder
had a lower False Alarm Rate which might be attributable to
its favorable applications in fields where it is important to
avoid false positives occurrences such as military
surveillance. To contextualize these findings by placing
them within the broader field of machine learning for
cybersecurity, a comparison was established with the other
state-of-the-art anomaly detection methods often given
attention in the most recent literature with the example
given in Figure 2. The techniques were SVM, Decision
Trees, and Neural Networks among many others.

Fig 1. Hybrid Model Flow

Loss Function: The reconstruction loss is applied, using to

see how well the output of the encoder-decoder system can
restore the given sample [15].
Optimizer: The Adam algorithm works on minimizing the
error during training by maximizing the reconstruction.
Model Evaluation: The performance of each model is
measured through its capacity to classify data accurately,
where having the greatest number of correct classifications
is regarded highly. The metrics measured take place in.
Anomaly Detection Rate (ADR): The detection of true Fig 2. State-of-the-art Comparison
anomalies becomes the main factor currently evaluated by
the model. The results show that both Isolation Forests and
Mean Time to Detect (MTTD): Statistical representation Autoencoders which are anomaly detection effective
of the mean the model took to identify an anomaly once it detection tools are sensitive to anomaly type and structure of
has occurred. data. Ensemble techniques of Isolation Forests are not many
and those are highly effective for tackling large datasets

1019
Authorized licensed use limited to: Zhejiang University. Downloaded on August 05,2025 at 16:32:01 UTC from IEEE Xplore. Restrictions apply.
 2024 International Conference on Circuit Power and Computing Technologies (ICCPCT)

quickly that tend to be observed in real-time based cyber true power of elaborate features such as deeper feature pools
threat detection. While on the one hand, Autoencoders as well as transfer learning which could promote the idea of
indeed can use their ability to reconstruct data to develop an producing more generic and scalable solutions.
in-depth knowledge of normality and anomaly and therefore
contribute to the reduction of false positives, on the other REFERENCES
hand, data clustering also proves to be good at detecting the [1] S. J. Et al., "Enhancing Cyber Security through Machine
presence of an outlier to ensure the robustness of the Learning-Based Anomaly Detection in IoT Networks,"
model. The suggested study frequently encountered some International Journal on Recent and Innovation Trends in
challenges in the research. This was the core problem along Computing and Communication, vol. 11, no. 10, 2023.
[2] F. Carrera, V. Dentamaro, S. Galantucci, A. Iannacone,
the lines of the searching speed versus precision and the
D. Impedovo, and G. Pirlo, "Combining Unsupervised
consistency of the results received. Moreover, the Approaches for Near Real-Time Network Traffic
remarkably different results that appeared between diverse Anomaly Detection," Applied Sciences, 2022.
attack scenarios insinuated that it is likely that a hybrid [3] A. L. Alfeo, M. Cimino, G. Manco, E. Ritacco, and G.
approach, which combines more than one machine learning Vaglini, "Using an autoencoder in the design of an
model, should be considered. The next step could be a anomaly detector for smart manufacturing," Pattern
system that augments both Isolation Forests and Recognit. Lett., vol. 136, pp. 272-278, 2020.
Autoencoders, combining the strengths of both methods [4] D. Laura Aguilar, M. A. Medina-Pérez, O. Loyola-
while getting around the output errors of González, K. Choo, and Edoardo Bucheli-Susarrey,
"Towards an Interpretable Autoencoder: A Decision-
autoencoders. Furthermore, a finding of the second stage
Tree-Based Autoencoder and its Application in Anomaly
examination is establishing the implications of more in- Detection," IEEE Transactions on Dependable and
depth network traffic analytics and their effectiveness on the Secure Computing, vol. 20, pp. 1048-1059, 2023.
model accuracy and robustness. The last area that has been [5] A. Hariharan, Ankit Gupta, and T. Pal, "CAMLPAD:
identified for improvement is leveraging transfer learning to Cybersecurity Autonomous Machine Learning Platform
customize the models that are trained on one type of for Anomaly Detection," ArXiv, vol. abs/1907.10442,
network traffic to other types to broadly use it. 2019.
[6] Y. Jaoudi, C. Yakopcic, and T. Taha, "Conversion of an
V. CONCLUSION Unsupervised Anomaly Detection System to Spiking
Neural Network for Car Hacking Identification," 2020
The exploitation of machine learning in cybersecurity, with 11th International Green and Sustainable Computing
the help of Isolation Forests and Autoencoders for anomaly Workshops (IGSC), 2020.
detection, proved to be a powerful tool for cybersecurity [7] T. Smolen and L. Benova, "Comparing Autoencoder and
professionals for faster detection and aggregation of cyber Isolation Forest in Network Anomaly Detection," 2023
threats, and also sharpening the cybersecurity response. This 33rd Conference of Open Innovations Association
piece of research was conducted to critically assess the (FRUCT), pp. 276-282, 2023.
applicability of these models in the detection of unusual [8] V. Toufigh and Iman Ranjbar, "Unsupervised deep
veering within network traffic that may indicate an ill- learning framework for ultrasonic-based distributed
damage detection in concrete: integration of a deep auto-
intention activity. This study has shown the strengths of both encoder and Isolation Forest for anomaly detection,"
Isolation Forests and Autoencoders as useful and Structural Health Monitoring, 2023.
complementary components of cybersecurity collections; [9] R. Sharma, V. Kukreja, R. K. Kaushal, A. Bansal and A.
Isolation Forests focus their strength on one particular Kaur, "Rice Leaf blight Disease detection using multi-
aspect of anomaly detection while Autoencoders efficiently classification deep learning model," 2022 10th
deliver other aspects. The Isolation Forest approach International Conference on Reliability, Infocom
exhibited its competence in simple anomaly detection by Technologies and Optimization (Trends and Future
providing very highly accurate and consistent results that are Directions) (ICRITO), Noida, India, 2022, pp. 1-5.
most suitable in situations where time is paramount. On the [10] Y. Patel et al., “Deepfake Generation and Detection:
Case Study and Challenges,” IEEE Access, vol. 11, pp.
other hand, Autoencoder seems to be a more advantageous 143296–143323, 2023.
means of distinguishing species in conditions involving a [11] P. Singla, Niharika, R. jain, R. Sharma, V. Kukreja and
higher rate of false alarms. The fact that our algorithm holds A. Bansal, "Deep Learning Based Multi-Classification
its own against some of the best-performing algorithms in Model for Rice Disease Detection," 2022 10th
the world gives rise to a wide consensus that these models International Conference on Reliability, Infocom
might compete well separately but they might complement Technologies and Optimization (Trends and Future
each other when combined. Hybridism is possibly the next Directions) (ICRITO), Noida, India, 2022, pp. 1-5.
big thing in modeling. On the other hand, this survey also [12] D. Kumar and V. Kukreja, "N-CNN Based Transfer
promotes the bi-directional relation between model Learning Method for Classification of Powdery Mildew
Wheat Disease," 2021 International Conference on
complexity, detection precision, and operational Emerging Smart Computing and Informatics (ESCI),
effectiveness. With the cyber threats constantly mutating in Pune, India, 2021, pp. 707-710.
sophistication and subtleness, the input of more intricate and [13] S. K. Brar, R. Sharma, S. Vats, and V. Kukreja, "A smart
flexible models becomes an urgent necessity. Hence, new approach to coconut leaf spot disease classification using
investigations will be strong concerning achieving the computer vision and deep learning technique," in Proc.
integration of these models with hybrid approaches, which World Conf. Commun. & Comput. (WCONF), 2023, pp.
will take into account the capabilities offered by different 1-6.
machine learning methods to generate more effective and [14] V. Kukreja, R. Sharma, and S. Vats, "A Hybrid Deep
efficient systems. Likewise, we may aim at excavating the Learning Approach for Multi-Classification of Heritage

1020
Authorized licensed use limited to: Zhejiang University. Downloaded on August 05,2025 at 16:32:01 UTC from IEEE Xplore. Restrictions apply.
 2024 International Conference on Circuit Power and Computing Technologies (ICCPCT)

Monuments Using a Real-Phase Image Dataset," in Proc. Learning: Deep Learning for Rapid Detection and
5th Int. Conf. Inventive Res. Comput. Appl. (ICIRCA), Classification of Sugarcane Diseases," in Proc. World
2023, pp. 29-32. Conf. Commun. & Comput. (WCONF), 2023, pp. 1-6.
[15] S. K. Brar, R. Sharma, S. Vats, and V. Kukreja, "Sugar

1021
Authorized licensed use limited to: Zhejiang University. Downloaded on August 05,2025 at 16:32:01 UTC from IEEE Xplore. Restrictions apply.