Виявлення та інтерпретація аномалій за допомогою методів Isolation Forest та SHAP

Abstract

A method for detecting anomalies in network traf ic based on the Isolation Forest approach is proposed, enabling ef ective identification of atypical behaviour that may indicate potential cybersecurity threats. The study covers the stages of traf ic preprocessing, model hyperparameter tuning, and evaluates the interpretability of the results using the SHAP method to identify the most influential features af ecting the model's decisions.