Problem
Network-flow data can be easy to over-interpret. High frequency, rare ports, and large transfers are useful observations, but none of them automatically establish malicious behavior.
Research approach
The project validates telemetry before interpretation, engineers behavioral features, establishes host and service baselines, and ranks unusual observations for analyst review.
- Schema and port validation
- Robust descriptive statistics
- Destination concentration and normalized entropy
- Isolation Forest anomaly triage
- Contamination sensitivity analysis
- Analyst-friendly deviation explanations
Security lesson
The central methodological lesson is simple: an anomaly is a question worth asking, not an incident verdict. Security conclusions require corroborating evidence from identity, endpoint, DNS, application, asset, and change-management context.
Engineering direction
The next step is converting the research notebook into reusable Python tooling with tests, configuration, logging, a command-line interface, reproducible reports, and an analyst investigation console.