Journal: Volume 30, No. 2, 2025
Pages: 63 – 76
DOI: https://doi.org/10.62660/bcstu/2.2025.63
1,203 Views

Intrusion detection in telecommunications networks using network traffic analysis

Andriy Riy, Maryan Kyryk
Received 05.01.2025
Revised 22.04.2025
Accepted 16.06.2025

Abstract

The growth of cyber threats and network traffic has highlighted the need for effective methods for detecting anomalies. The purpose of the study was to develop a hybrid model for detecting anomalies in telecommunications networks with increased accuracy based on comparative analysis of uncontrolled algorithms. Four main algorithms were compared: Isolation Forest, Local Outlier Factor (LOF), One-Class Support Vector Machine (SVM), and Elliptic Envelope using simulated network traffic data. Analysis methods included data normalisation using Z-score and Min-Max Scaling to eliminate large-scale differences between traits. An ensemble of 100 decision trees was used to improve the accuracy of anomaly detection. As a result, it was found that Isolation Forest provided the highest accuracy of anomaly detection (F1-Score = 85.8%) and high processing speed (processing time per 10,000 records in 2.5 seconds), which is important for real-world conditions of telecommunications networks with large amounts of data. LOF showed high accuracy in detecting local anomalies, but with greater computational complexity. The one-class SVM algorithm detected global anomalies, but showed lower accuracy for local ones. Elliptic Envelope had limited performance due to the assumption of normal data distribution. Additionally, a comprehensive model was developed that combined the advantages of Isolation Forest, LOF, and Density-Based Spatial Clustering of applications with Noise, which allowed increasing the F1-Score to 88% and exceeding the results of individual models. The hybrid model showed adaptability to multimodal distributions and efficiency in detecting local anomalies. Practical significance lies in improving the accuracy and stability of network security systems and form the basis for adaptive real-time algorithms, which allowed cybersecurity and telecommunications specialists to more effectively monitor and protect networks from threats

Keywords

anomaly detection; performance evaluation; scalability; accuracy; unsupervised algorithms; hybrid model; clustering

References

  1. Adhikari, D., Jiang, W., Zhan, J., Rawat, D.B., & Bhattarai, A. (2024). Recent advances in anomaly detection in Internet of Things: Status, challenges, and perspectives. Computer Science Review, 54, article number 100665. doi: 10.1016/j.cosrev.2024.100665.
  2. Agyemang, E.F. (2024). Anomaly detection using unsupervised machine learning algorithms: A simulation study. Scientific African, 26, article number e02386. doi: 10.1016/j.sciaf.2024.e02386.
  3. Ahmad, R., Alsmadi, I., Alhamdani, W., & Tawalbeh, L. (2023). Zero-day attack detection: A systematic literature review. Artificial Intelligence Review, 56, 10733-10811. doi: 10.1007/s10462-023-10437-z.
  4. Ahmed, M., Chen, J., Akpaku, E., & Sosu, R.N. (2025). MTCR-AE: A multiscale temporal convolutional recurrent autoencoder for unsupervised malicious network traffic detection. Computer Networks, 261, article number 111147. doi: 10.1016/j.comnet.2025.111147.
  5. Akif, M.A., Butun, I., Williams, A., & Mahgoub, I. (2025). Hybrid machine learning models for intrusion detection in IoT: Leveraging a real-world IoT dataset. ArXiv, 2502, article number 12382. doi: 10.48550/ arXiv.2502.12382.
  6. Akuthota, U.C., & Bhargava, L. (2025). The role of machine and deep learning in modern intrusion detection systems: A comprehensive review. Computers and Electrical Engineering, 124, article number 110318. doi: 10.1016/j.compeleceng.2025.110318.
  7. AL-Husseini, H., Hosseini, M.M., Yousofi, A., & Alazzawi, M.A. (2024). Whale optimization algorithm-enhanced long short-term memory classifier with novel wrapped feature selection for intrusion detection. Journal of Sensor and Actuator Networks, 13(6), article number 73. doi: 10.3390/jsan13060073.
  8. Anser, O., François, J., & Chrisment, I. (2024). Automated machine learning configuration to learn intrusion detectors on attack-free datasets. In Proceedings of the 49th IEEE conference on local computer networks (pp. 1-7). Normandy: IEEE. doi: 10.1109/LCN60385.2024.10639690.
  9. Canadian Institute for Cybersecurity Intrusion Detection System. (2017). Retrieved from https://www.unb.ca/ cic/datasets/ids-2017.html.
  10. Chychkarov, Y., Zinchenko, O., Bondarchuk, A., & Aseeva, L. (2023). Detection of network intrusions using machine learning algorithms and fuzzy logic. Electronic Professional Scientific Journal “Cybersecurity: Education, Science, Technique”, 3(19), 209-225. doi: 10.28925/2663-4023.2023.19.209225.
  11. Cohen, S., Goldshlager, N., Shapira, B., & Rokach, L. (2023). TTANAD: Test-time augmentation for network anomaly detection. Entropy, 25(5), article number 820. doi: 10.3390/e25050820.
  12. Dairi, A., Harrou, F., Bouyeddou, B., Senouci, S.-M., & Sun, Y. (2023). Semi-supervised deep learning-driven anomaly detection schemes for cyber-attack detection in smart grids. In H.H. Alhelou, N. Hatziargyriou & Z.Y. Dong (Eds.), Power systems cybersecurity: Methods, concepts, and best practices (pp. 265-295). Cham: Springer. doi: 10.1007/978-3-031-20360-2_11.
  13. Diana, L., Dini, P., & Paolini, D. (2025). Overview on intrusion detection systems for computers networking security. Computers, 14(3), article number 87. doi: 10.3390/computers14030087.
  14. Firdaus, G.M., & Suryani, V. (2024). Enhanced pruning process with DBSCAN for attack detection. In Proceedings of the 2024 1st international conference on cyber security and computing (pp. 113-118). Melaka: IEEE. doi: 10.1109/CyberComp60759.2024.10913747.
  15. Gutierrez-Portela, F., Almenares Mendoza, F., & Calderon-Benavides, L. (2024). Evaluation of the performance of unsupervised learning algorithms for intrusion detection in unbalanced data environments. IEEE Access, 12, 190134-190157. doi: 10.1109/ACCESS.2024.3516615.
  16. Haidur, H.I., Gakhov, S.O., & Bryhynets, A.A. (2023). Detection of network anomalies with neural networks algorithms. Telecommunication and Information Technologies, 78(1), 61-73. doi: 10.31673/2412-4338.2023.010416.
  17. Hassan, T.J., Ramchandra, A.R., & Ranganathan, P. (2024). Modeling and evaluation of false data injection attacks (FDIA) in DER inverters. In Proceedings of the 56th North American power symposium (pp. 1-7). El Paso: IEEE. doi: 10.1109/NAPS61145.2024.10741736.
  18. He, H., Liu, K., Zhang, L., Xu, K., Li, J., & Ren, J. (2025). TE-PADN: A poisoning attack defense model based on temporal margin samples. Big Data Research, 40, article number 100528. doi: 10.1016/j.bdr.2025.100528.
  19. Ilin, D., & Starinskyi, I. (2023). Mathematical model of an intrusion detection system using a neural network based on auto-encoders. Modern Information Technologies in the Sphere of Security and Defence, 47(2), 113-118. doi: 10.33099/2311-7249/2023-47-2-113-118.
  20. Iturbe-Araya, J.I., & Rifà-Pous, H. (2025). Enhancing unsupervised anomaly-based cyberattacks detection in smart homes through hyperparameter optimization. International Journal of Information Security, 24, article number 45. doi: 10.1007/s10207-024-00961-6.
  21. Loo, F.-N., Chen, T.-S., Tsai, C.-W., Lin, J., & Yang, C.-W. (2024). Feasibility study of semi-supervised intrusion detection systems for industrial control systems. In Proceedings of the 10th international conference on applied system innovation (pp. 166-168). Kyoto: IEEE. doi: 10.1109/ICASI60819.2024.10547975.
  22. Lu, K.-C., Liu, I.-H., Liu, Z.-C., & Li, J.-S. (2024). Common criteria for security evaluation and malicious intrusion detection mechanism of dam supervisory control and data acquisition system. IET Networks, 13(5-6), 546-559. doi: 10.1049/ntw2.12127.
  23. Meidan, Y., Avraham, D., Libhaber, H., & Shabtai, A. (2023). CADeSH: Collaborative anomaly detection for smart homes. IEEE Internet of Things Journal, 10(10), 8514-8532. doi: 10.1109/JIOT.2022.3194813.
  24. Nikitenko, A., & Bashkov, Y. (2024). Construction of a network intrusion detection system based on a convolutional neural network and a bidirectional gated recurrent unit with attention mechanism. Eastern-European Journal of Enterprise Technologies, 3(9), 6-15. doi: 10.15587/1729-4061.2024.305685.
  25. Rajathi, C., & Rukmani, P. (2025). Hybrid learning model for intrusion detection system: A combination of parametric and non-parametric classifiers. Alexandria Engineering Journal, 112, 384-396. doi: 10.1016/j. aej.2024.10.101.
  26. Russell-Gilbert, A., Mittal, S., Rahimi, S., Seale, M., Jabour, J., Arnold, T., & Church, J. (2025). RAAD-LLM: Adaptive anomaly detection using LLMs and RAG integration. ArXiv, 2503, article number 02800. doi: 10.48550/ arXiv.2503.02800.
  27. Sharma, N., Arora, B., Ziyad, S., Singh, P.K., & Singh, Y. (2024). A holistic review and performance evaluation of unsupervised learning methods for network anomaly detection. International Journal on Smart Sensing and Intelligent Systems, 17(1), article number 16. doi: 10.2478/ijssis-2024-0016.
  28. Shukla, A.K., Srivastav, S., Kumar, S., & Muhuri, P.K. (2023). UInDeSI4.0: An efficient unsupervised intrusion detection system for network traffic flow in Industry 4.0 ecosystem. Engineering Applications of Artificial Intelligence, 120, article number 105848. doi: 10.1016/j.engappai.2023.105848.
  29. Srivastav, S., Shukla, A.K., Kumar, S., & Muhuri, P.K. (2025). HYRIDE: HYbrid and Robust Intrusion DEtection approach for enhancing cybersecurity in Industry 4.0. Internet of Things, 30, article number 101492. doi: 10.1016/j.iot.2025.101492.
  30. Tsai, C.-W., Lu, C.-T., Li, C.-H., & Zhang, S.-W. (2024). An effective ensemble electricity theft detection algorithm for smart grid. IET Networks, 13(5-6), 471-485 doi: 10.1049/ntw2.12132.
  31. Uddin, M.A., Aryal, S., Bouadjenek, M.R., Al-Hawawreh, M., & Talukder, M.A. (2024). UsfAD based effective unknown attack detection focused IDS framework. Scientific Reports, 14, article number 29103. doi: 10.1038/ s41598-024-80021-0.
  32. Zoppi, T., Ceccarelli, A., Puccetti, T., & Bondavalli, A. (2023). Which algorithm can detect unknown attacks? Comparison of supervised, unsupervised and meta-learning algorithms for intrusion detection. Computers and Security, 127, article number 103107. doi: 10.1016/j.cose.2023.103107.

Suggested citation

Riy, A., & Kyryk, M. (2025). Intrusion detection in telecommunications networks using network traffic analysis. Bulletin of Cherkasy State Technological University, 30(2), 63-76. https://doi.org/10.62660/bcstu/2.2025.63