Which models are used?

The system is based on unsupervised anomaly detection models designed to work without labeled data.

Currently used approaches include:

• Isolation Forest and related methods;
• statistical and behavioral profiling;
• custom feature extraction (partially implemented in C++).

The models are chosen because they:

• do not require labeled datasets;
• are resilient to noise;
• operate effectively on limited resources.