Learning from the Normal: Anomaly-Based Intrusion Detection Using Isolation Forest

Abstract

The increasing sophistication of cyberattacks necessitates intrusion detection systems capable of identifying previously unseen threats without relying on labeled attack data. This study presents a systematic cross-dataset evaluation of three classical unsupervised anomaly detection algorithms

namely Isolation Forest

Local Outlier Factor (LOF)

and One-Class Support Vector Machine (OC-SVM)

under a realistic novelty detection protocol. Models were trained exclusively on benign traffic and evaluated on mixed test sets using two widely adopted benchmark datasets

NSL-KDD and CIC-IDS2017. Performance was assessed using precision

recall

F1-score

confusion matrices

and computational runtime. Experimental results reveal dataset-dependent optimality. OC-SVM achieved the highest performance on NSL-KDD with an F1-score of 0.9948

driven primarily by error-rate and host-level aggregation features

while LOF outperformed other models on CIC- IDS2017 with an F1-score of 0.9890

effectively capturing timing irregularities and burst flow behavior characteristic of DDoS traffic. Principal Component Analysis (PCA) significantly reduced computational cost

achieving up to 65 to 70 percent reduction in training time for kernel-based models without degrading detection accuracy. SHAP-based explainability analysis demonstrated that model decisions align with statistically meaningful network behavior indicators rather than spurious correlations. The findings highlight that anomaly detection performance is strongly influenced by dataset structure and attack dynamics

and no single model universally dominates across heterogeneous intrusion scenarios. The proposed framework provides practical guidance for selecting lightweight

interpretable unsupervised detection models tailored to specific network environments.