An Isolation Forest needs no labels at all. Gradient boosting and an RBF support vector machine need thousands. So the question nobody puts in the tutorial is: how many labels do you have to buy before supervision is worth it — and does it matter which flows you pick?
Every flow carries ten features — duration, bytes each way, packet rate, distinct destination ports, failed logins, SYN error rate, same-host connection rate and how regular the connection intervals are. Two of the attacks are deliberately hard. Exfiltration hides behind the nightly backup upload; C2 beacon hides behind service health checks. On every single one of the ten features, their median sits inside the ordinary range of benign traffic. Only the joint pattern gives them away — which is exactly the situation where a labelled example is worth more than a clever unsupervised score.
One run, in order, at analyst pace. Flows arrive, the ones your strategy picks go to a human, and the two supervised models retrain as the labels land. The Isolation Forest never receives a single one, so its line does not move — watch whether the others reach it, and what it costs when they do.
The queue above is one run, and one run is noisy — at 1% prevalence a sample of 400 flows holds about four attacks, and which four you happened to get moves the score a long way. So the same experiment again, properly: each point trains both models from scratch on a fresh labelled sample and scores them on 6,000 held-out flows, repeated across several seeds. The vertical bars are ±1 standard deviation across those runs — where they are tall, do not trust a single number. The Isolation Forest line is flat because it never gets any labels — that is the bar the other two have to clear.
Triaging one network flow properly — pivot to the packet capture, check the host, check the destination's reputation — takes an analyst about minutes.
Average precision is one number, and one number hides the interesting part. Broken out by archetype — recall inside a false-positive budget of one benign flow in a hundred — the three detectors fail in completely different places.
| Attack archetype | Hides behind | Recall at 1% false-positive rate | Share |
|---|
Isolation Forest — 140 trees, subsample 256,
anomaly score from expected path length. Fitted on the unlabelled pool, so
contaminated by the attacks inside it, as it would be in production.
Gradient boosting — histogram-based, 32 bins,
depth 3, 60 rounds, logistic loss, balanced class weights.
RBF-SVM — the kernel approximated by 192 random
Fourier features, then a linear hinge-loss SVM by averaged SGD with the Pegasos
norm projection.
All three are written from scratch in about 500 lines of JavaScript. There is no
library on this page and no server call — the numbers you are reading were
computed on your machine, seconds ago.
The data is synthetic. It is built so that two archetypes are genuinely
unresolvable from their benign cover on any single feature — that is checked
by an automated test, not asserted — but a generator is still a model of
reality, not reality.
Real NetFlow brings drift, seasonality, correlated flows within a session, and
labels that are themselves wrong. All of that pushes in the same direction:
it makes the supervised curves worse, not better.
Average precision is reported on a fixed held-out set drawn from the same
distribution. That is the friendliest possible test. A held-out
future would be harder.