About Anomaly Detection

This page displays login attempts flagged as anomalies using a machine learning model called Isolation Forest. The Isolation Forest model identifies unusual login patterns by looking for data points that differ significantly from the majority. It uses four key features from the login data to detect anomalies:

• Hour of Attempt: The hour when the login attempt was made.
• Day of the Week: The day the attempt occurred, which helps identify if it happened on an unusual day.
• Failed Attempts: The number of failed login attempts from the same IP or user.
• Success Ratio: The ratio of successful to total attempts, which highlights repeated failed attempts.

If a login attempt looks very different from typical patterns (such as occurring at an odd hour or having too many failed attempts), it is flagged as an anomaly. The following table shows these flagged attempts, updated every 5 minutes.