Modern network infrastructures are faced with an exponential increase in cyber threats, which range from denial-of-service attacks to intelligent stealth intrusions engineered to bypass traditional security systems. Traditional IDS often struggles with real-time responsiveness due to high computational costs and poor adaptability against evolving threats. This paper, therefore, proposes a lightweight, Python-based real-time Intrusion Detection Framework for flow-level network traffic. The proposed framework is built using the Isolation Forest algorithm (Li, Li, & Li, 2021; Ahmed & Hameed, 2023), anomaly-based detection utilizing unsupervised learning with no requirement for large amounts of labeled data. A graphical user interface is integrated into the model using Tkinter to enhance usability, improve interpretability, and enable real-time visualization of outputs related to anomaly detection. The experiments on publicly available, flow-level dataset (CICIDS2017 Dataset, 2024)s show high precision, accurate anomaly flagging, and low false-positive rates, hence validating the appropriateness of the model in constrained computing environments and real-time security applications. Emphasis has been placed on a pragmatic resource-efficient approach; hence, this work is of particular relevance to academic institutions, SMEs, and research-oriented networks seeking scalable security solutions.

Keywords: Anomaly detection, flow-level traffic, Python, Isolation Forest, real-time IDS, cybersecurity.