AI-based user-level anomaly detection in internet service providers using unsupervised learning

Ullah, Saif and Motakabber, S.M.A and Khalifa, Othman Omran and Uddin, Jia (2026) AI-based user-level anomaly detection in internet service providers using unsupervised learning. International Journal on Advance Science Engineering Information Technology (IJASEIT), 16 (5). pp. 1584-1593. ISSN 2088-5334

PDF - Published Version Restricted to Registered users only Download (1MB) | Request a copy

Abstract

Detecting user-level anomalies in Internet Service Provider (ISP) networks is difficult because labeled ground truth is unavailable, and single-model decisions are rarely stable. Identifying long-term abnormal behavior is even harder because user activity patterns change continuously in operational environments. In this study, we present a consensus-based analysis mechanism for userlevel anomaly detection using real operational network logs, including 546,277 event-level records from 398 users. We characterized user activity using aggregated metadata statistics. These included event volume, port diversity, and packet length measures. We applied three unsupervised learning techniques: Autoencoder, Isolation Forest, and One-Class Support Vector Machine (SVM). We combined their outputs through a two-out-of-three majority voting scheme to produce the final anomaly decision. The results show that each model identifies anomalies differently, with rates ranging from 1.01% to 4.52%. The suggested consensus technique reduced the final anomaly rate to 0.75%, showing more reliable decisions and less bias against specific models. The agreement-based evaluation showed that the Autoencoder was the most in line with the final consensus decision, with a Cohen kappa value of 0.856. SHapley Additive exPlanations (SHAP) and Model-Agnostic Explanations (LIME) were used to identify the most important features for anomaly detection: packet length characteristics and port variety. The suggested framework offers a scalable, flexible, and understandable method for metadata-based monitoring in real ISP networks.

Item Type:	Article (Journal)
Uncontrolled Keywords:	Internet service provider networks user-level anomaly detection unsupervised learning explainable artificial intelligence
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK5101 Telecommunication. Including telegraphy, radio, radar, television
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Engineering
Depositing User:	Dr S M A Motakabber
Date Deposited:	10 Nov 2026 11:27
Last Update:	10 Nov 2026 11:27
Queue Number:	2026-11-Q6162
URI:	http://irep.iium.edu.my/id/eprint/132634
Indexed In:	SCOPUS

Actions (login required)

View Item