Context-Aware Network Behaviour Analyser

Abstract

Conventional network-security tools such as firewalls and intrusion-detection systems examine packets, ports, protocols and signatures, but they rarely capture the application, process, user and operating conditions behind a connection. This gap makes it hard to separate legitimate activity from suspicious behaviour, especially when malicious traffic rides on commonly permitted ports or hides inside encrypted channels. This review paper surveys existing work in traffic classification, deep packet inspection, application-aware firewalls and machine-learning-based anomaly detection, and uses these findings to motivate a proposed Context-Aware Network Behaviour Analyser. The proposed system correlates live network flows with the originating process, the logged-in user, the time of activity and the host\'s recent behaviour, builds behavioural baselines for applications and users, and applies statistical and machine-learning techniques to flag meaningful deviations. A real-time dashboard is envisaged to present flows, process-to-flow associations, user activity and context-rich alerts to support faster investigation. The paper concludes by outlining an evaluation plan that compares the proposed analyser with a conventional rule-based monitor on detection rate and false-positive rate.

Introduction

The Context-Aware Network Behaviour Analyser is a proposed lightweight security system designed to improve network monitoring by combining network traffic analysis with application, process, user, and temporal information. Traditional network monitoring relies mainly on IP addresses, port numbers, protocols, and known attack signatures. Although these methods are effective against familiar threats, they may fail to identify malicious activities hidden within encrypted traffic, trusted applications, or commonly permitted network ports.

The literature review examines four major areas: network traffic classification and deep packet inspection, machine-learning-based traffic classification, application-aware firewalls, and network anomaly detection. Existing approaches provide useful capabilities, such as identifying traffic patterns, associating connections with processes, and detecting unusual network behaviour. However, these techniques are often implemented independently, limiting their ability to provide a complete understanding of suspicious activity.

The proposed system addresses this research gap by integrating six main stages: traffic capture, process-to-flow mapping, context enrichment, behavioural baselining, anomaly detection, and explainable alerting. Network packets are captured using tools such as Scapy, PyShark, or libpcap and grouped into flows. Each flow is then associated with its originating process using operating-system information. Additional context, including user activity, connection time, traffic volume, destination history, and application behaviour, is collected to create a comprehensive record of network activity.

The system establishes behavioural baselines for individual applications and users by analysing normal communication patterns, typical destinations, connection frequency, data transfer volumes, and active hours. New network connections are evaluated against these baselines using rule-based thresholds and unsupervised machine-learning algorithms, such as Isolation Forest. Suspicious activities are assigned low, medium, or high risk levels based on their characteristics and deviations from expected behaviour.

An explainable alerting module provides human-readable descriptions of suspicious connections, identifying the responsible process, destination, and reason for the alert. A proposed Streamlit dashboard and SQLite database support real-time visualisation, alert history, and persistent storage of network activity, helping security analysts investigate threats more efficiently.

The main research gap is the limited integration of process attribution, user and temporal context, behavioural learning, and explainable anomaly detection into a single lightweight monitoring framework. The proposed system aims to reduce false alarms, improve threat visibility, and accelerate security investigations. However, its effectiveness will depend on implementation quality, baseline accuracy, operating-system permissions, and evaluation under realistic network conditions.

Conclusion

This review has surveyed traffic classification, deep packet inspection, application-aware firewalls and behavioural anomaly detection, and used the survey to identify a common limitation: most existing tools address only one of these layers in isolation, leaving a gap in systems that combine process-level attribution, user/temporal context and learned behavioural baselining. The proposed Context-Aware Network Behaviour Analyser addresses this gap by combining flow capture, process attribution, contextual enrichment and behavioural anomaly detection into a single, lightweight system. By adding application-, user- and behaviour-level visibility to conventional traffic analysis, the proposed system aims to complement existing network-security mechanisms, reduce false positives, and provide more meaningful information to security analysts. Future work will focus on building and evaluating the prototype described in Section IV against the plan outlined in Section V.

References

[1] K. Sethi, R. Kumar, N. Prajapati, and P. Bera, \"A context-aware robust intrusion detection system: a reinforcement learning-based approach,\" International Journal of Information Security, vol. 19, no. 6, 2020. [2] S. Neupane, J. Ables, W. Anderson et al., \"Explainable intrusion detection systems (X-IDS): a survey,\" IEEE Access, vol. 10, 2022. [3] \"Anomaly detection in encrypted network traffic using self-supervised learning,\" Scientific Reports, vol. 15, 2025. [4] \"Network Traffic Classification: Techniques, Datasets, and Challenges,\" Higher Education Press / ScienceDirect. [5] \"Deep Packet: A Novel Approach for Encrypted Traffic Classification Using Deep Learning,\" arXiv. [6] \"A Survey on Deep Packet Inspection,\" ResearchGate. [7] \"Application-Aware Firewall Mechanism for Software Defined Networks,\" Journal of Network and Systems Management, Springer. [8] \"Application Firewall,\" HandWiki. [9] \"Estimating Traffic and Anomaly Maps via Network Tomography,\" arXiv. [10] \"Network Traffic Classification for Data Fusion: A Survey,\" ScienceDirect.

Copyright

Copyright © 2026 Shrey Akulwar, Prof. Vibha D. Gomase, Gopala Awadhi , Mohan R. Bhandekar , Khushi Sakhare , Jagruti Patle. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.