Traffic.
Under scrutiny.
Large-Scale Log Anomaly Detection
01 / Behind the experiment
Detect unusual HTTP traffic with behavioral features, an anomaly-detection ensemble, and drift monitoring. A separate FastAPI service serves Isolation Forest scores.
Captured API response
- DoS example
- Critical
- Anomaly score
- -0.1861
A real response to the synthetic DoS preset, captured Oct 14, 2026. This is a serving demonstration, not a detection-accuracy benchmark.
View evidence notes ↗Inside the projectProblem / decisions / limitations
01 / The problem
A high volume of server events makes manual inspection impractical. The project explores how to surface unusual behavior and give each alert useful context.
02 / Design decisions
Separate feature engineering, offline ensemble analysis, and a smaller scoring service. Track experiments with MLflow and inspect feature drift with KS tests and PSI.
03 / What to know
The 500K-row dataset is synthetic. Offline ensemble results and the deployed Isolation Forest service are different evaluation targets; they should not be presented as one benchmark.
