The problem
Can a model flag malicious network traffic having never been shown what an attack looks like — and can it catch attack types it has genuinely never encountered before? 125,973 training connections and 22,544 test connections from NSL-KDD, a standard benchmark for intrusion detection, were used to find out.
Key results
Why unsupervised, not supervised
A supervised classifier learns the specific patterns of the attacks it was trained on — shown a mailbomb attack for the first time, it has no learned representation for it. Unsupervised anomaly detection sidesteps this entirely: the model never learns what a specific attack looks like, only what normal traffic looks like, flagging meaningful deviations from that baseline. NSL-KDD's test set deliberately includes 17 attack types absent from training, making this distinction directly testable.
Two algorithms, compared honestly
Both models were trained purely on the feature data — true labels were used only afterward, to evaluate results, never during training.
| Model | Precision | Recall | F1 | Training time |
|---|---|---|---|---|
| Isolation Forest | 0.856 | 0.855 | 0.856 | Seconds, full dataset |
| One-Class SVM | 0.879 | 0.818 | 0.847 | 24.6s, 12% subsample |
One-Class SVM scored marginally higher on ranking-quality metrics, but only after training on a fraction of the data to keep runtime manageable — its cost grows steeply with sample size. Given near-identical F1-scores, Isolation Forest was selected as the final model: comparable accuracy, the full dataset, a fraction of the time.
A counterintuitive result
The expectation going in was straightforward: attack types never seen in training should be harder to catch. The data said otherwise.
The most plausible explanation: novel attacks in this dataset tend to produce traffic that's structurally very different from normal behavior — unusual byte volumes, atypical durations — making them easy to isolate almost by construction, independent of the model's familiarity with the attack's name. Some known attacks may instead generate traffic that more closely resembles normal behavior, making them genuinely harder to distinguish. This doesn't undermine the case for unsupervised detection — it still generalized well to novel threats — but the mechanism behind that result wasn't the one originally hypothesized, and it's reported here as found rather than adjusted to fit the expectation.