Isolation Forest · 100 trees · runs in your browser

Threat detector

Describe a connection and see how easily the model can isolate it from normal traffic.

01 · Connection

Real connections from the test set (bytes in → bytes out), grouped by how the two models rated them.

Typical traffic

Flagged by both models

Only the Isolation Forest

Bytes ratio0.0000

02 · Verdict

0.30 1.00

—

Anomaly score

Loading model…

Technical details 

      

    


    

      
03 · Time of day (UTC) 08:00


      

      
Each cell shows how the model rates this same traffic at that hour. Hatched hours fall outside the dataset window (23:00–10:00 UTC), so the model has no data there. Click a cell to select it.

    


    

      
04 · How it works


      
The model was trained in Python and exported to a JSON file. Your browser scores each connection locally, so nothing you type is sent anywhere.


      
    
        
  1. 
          
    Data
    
          
    282 web-traffic records from AWS CloudWatch, all already flagged as suspicious by WAF rules. 217 were used for training and 65 for testing.
    
        
    2. 
        
  2. 
          
    Features
    
          
    Bytes in, bytes out, hour of day (UTC) and the bytes ratio: bytes out ÷ (bytes in + 1).
    
        
    3. 
        
  3. 
          
    Isolation
    
          
    100 random decision trees try to separate each connection from the rest. Unusual traffic gets isolated in fewer splits.
    
        
    4. 
        
  4. 
          
    Score
    
          
    Shorter paths mean a higher anomaly score. Above 0.5, the threshold marked on the gauge, the connection is flagged.
    
        
    5. 
      


      
Versus a simple rule. A classic IQR rule on bytes in and out flagged 11 of the 65 test connections. The Isolation Forest flagged those 11 plus 8 more that look ordinary on bytes alone.


      
Keep in mind. The records span only 23:00 to 10:00 UTC on 25–26 April 2024, so the model has no information about other hours; they are hatched in the time-of-day strip. And since every record was already suspicious, "anomaly" here means unusual compared with that traffic, not a confirmed attack.