TY  - EJOU
AU  - Almufarreh, Ahmad 
AU  - Hassan, Rogaia  Osman 
AU  - Ahmad, Ashfaq 
AU  - Arshad, Muhammad 
AU  - Onn, Choo Wou 

TI  - Machine Learning-Based Network Traffic Anomaly Detection in Smart Learning Environments
T2  - Computers, Materials \& Continua

PY  - 
VL  - 
IS  - 
SN  - 1546-2226

AB  - The explosive increase in connectivity has multiplied the volume and speed of network traffic, putting the world at greater risk from sophisticated and emerging cyber-attacks. Smart learning environments, which rely on cloud-based learning management systems, virtual classrooms, and interconnected educational devices, generate large volumes of dynamic network traffic that must be continuously monitored to protect sensitive academic data and ensure uninterrupted learning services. In this study, three supervised machine learning classifiers, namely Random Forest, Logistic Regression, and k-Nearest Neighbours (kNN), are designed and evaluated for anomaly detection using the UNSW-NB15 benchmark. Models are trained and evaluated using a comprehensive set of metrics, including accuracy, precision, recall, F1-score, ROC-AUC, and confusion matrix analysis, following rigorous preprocessing and stratified cross-validation. Consistent with observed patterns in the dataset, Random Forest achieves near-perfect detection accuracy with very low false alarm rates, kNN performs well with moderate error rates, and Logistic Regression shows comparatively lower performance. This study develops a reproducible anomaly detection pipeline and provides a comparative evaluation that highlights the conditions under which ensemble and instance-based models outperform linear approaches in high-dimensional network traffic analysis. These findings align with existing evidence highlighting the effectiveness of data-centric machine learning pipelines in improving decision-making in high-volume digital environments. In the context of smart learning environments, these models can support the development of intelligent intrusion detection systems capable of monitoring educational network infrastructures and identifying abnormal traffic patterns associated with cyber threats targeting digital learning platforms. The findings provide practical guidance for selecting machine learning models in intrusion detection systems where detection performance must be balanced with computational efficiency and deployment constraints.
KW  - Anomaly detection; resilient infrastructure; intrusion detection; education quality; cybercrime

DO  - 10.32604/cmc.2026.082264