Log Anomaly Detector

Live Engine · Isolation Forest

Watch a real anomaly-detection model flag attacks in a live traffic feed

Idle

Simulated traffic. A live site can't stream its own request logs into a public page, so this generates a labelled stream — normal traffic plus a few planted attacks — and a real scikit-learn Isolation Forest on the backend scores it without seeing the labels.

—Baseline learned

—Requests processed

—Anomalies flagged

Live request feed

newest first

Press Run detection to start the feed.

What this is and isn't: the traffic is simulated, but the detector is a genuine unsupervised Isolation Forest (scikit-learn) learning “normal” from a baseline and flagging outliers in five real request features — requests/min, payload size, time of day, path randomness and error rate. The red chip on a flagged row names the single feature that deviates most from the baseline; it is a plain-English hint, not the model's internal reason. A real deployment would feed live logs and retrain on its own traffic. Attack kinds planted here: Brute force, Scraping / fuzzing, Payload spike, Off-hours burst.