LIFTS: Localized Isolation Forests Unsupervised Flow Anomaly Detection

LIFTS is a reproducibility package for evaluating a localized unsupervised flow anomaly detection pipeline on CIC-IDS-2017 network traffic. The package contains a standalone Python implementation, dependency list, run instructions, generated result tables and figures, and cache-aware loading for the expected CIC-IDS-2017 CSV files. The pipeline learns benign behavior for the CIC-IDS-2017 victim host 192.168.10.50, filters flows associated with that host, discovers service modes from protocol and destination-port combinations, trains per-mode Isolation Forest anomaly detectors with fallback models, detects temporal/cycle modes, and optionally applies two-state Gaussian HMM smoothing to anomaly scores. The evaluation reproduces two regimes: a single-day setting trained on Monday benign traffic and evaluated on Tuesday through Friday, and a leave-one-day-out setting trained on benign traffic from the remaining days and evaluated on the held-out day. Reported detector variants are SM_raw, SM_hmm, CM_raw, and CM_hmm. Outputs include confusion matrices, precision-recall curves, threshold sweeps, F1 matrices, per-day grids, attack-family recall, MCC/FPR plots, balanced accuracy plots, and summary tables.