title: ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð² Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ð¸ Ð°Ð½Ð¾Ð¼Ð°Ð»ÑÐ½Ð¾Ð³Ð¾ ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÑÐ°ÑÐ¸ÐºÐ°
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: The use of machine learning in identification abnormal traffic
Creators: name: ÐÑÐ¾Ð·Ð´Ð¾Ð², ÐÑÑÐµÐ¼
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
ÑÐµÑÐµÐ²Ð°Ñ Ð°ÑÐ°ÐºÐ°
information security
machine learning
network attack

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¾ÑÐ½Ð¾ÑÐ¸ÑÑÑ Ðº ÑÑÐµÑÐµ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. ÐÑÐ¸Ð¼ÐµÐ½Ð¸Ð¼Ð°, Ð² ÑÐ°ÑÑÐ½Ð¾ÑÑÐ¸, Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÑÐµÐ²ÑÑ Ð°ÑÐ°Ðº. Ð Ð¿ÐµÑÐ²Ð¾Ð¹ Ð³Ð»Ð°Ð²Ðµ Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ ÑÐµÑÐµÐ²ÑÑ Ð°ÑÐ°Ðº Ð¿Ð¾ ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÐ¼ ÐºÑÐ¸ÑÐµÑÐ¸ÑÐ¼, Ð° ÑÐ°ÐºÐ¶Ðµ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¾, ÐºÐ°Ðº Ð¾Ð½Ð¸ Ð¼Ð¾Ð³ÑÑ Ð¿Ð¾Ð²Ð»Ð¸ÑÑÑ Ð½Ð° Ð·Ð°ÑÐ¸ÑÐ°ÐµÐ¼ÑÑ ÑÐ¸ÑÑÐµÐ¼Ñ. ÐÐ±Ð¾Ð·Ð½Ð°ÑÐµÐ½Ñ Ð±Ð°Ð·Ð¾Ð²ÑÐµ Ð¼ÐµÑÐ¾Ð´Ð¸ÐºÐ¸ Ð´ÐµÑÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐµÑÐµÐ²ÑÑ Ð°ÑÐ°Ðº, Ð°ÐºÑÐµÐ½ÑÐ¸ÑÐ¾Ð²Ð°Ð½Ñ Ð´Ð¾ÑÑÐ¾Ð¸Ð½ÑÑÐ²Ð° Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¸ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¸Ðº. ÐÐ¾ Ð²ÑÐ¾ÑÐ¾Ð¹ Ð³Ð»Ð°Ð²Ðµ Ð´Ð°Ð½Ð¾ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð°Ð¼ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐµÐ¼ÑÐ¼ Ð² ÑÐµÑÐµÐ½Ð¸Ð¸ Ð·Ð°Ð´Ð°Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. ÐÑÐ´ÐµÐ»ÐµÐ½Ñ Ð´Ð¾ÑÑÐ¾Ð¸Ð½ÑÑÐ²Ð° Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¸. ÐÐ¾ ÑÑÐµÑÑÐµÐ¹ Ð³Ð»Ð°Ð²Ðµ Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð¾ Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ðµ ÑÑÑÑÐºÑÑÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð°. ÐÐ¿Ð¸ÑÐ°Ð½Ñ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¸ ÑÐµÑÐµÐ²ÑÑ Ð¿Ð°ÐºÐµÑÐ¾Ð², ÑÑÐ°ÑÑÐ²ÑÑÑÐ¸Ñ Ð² Ð°Ð½Ð°Ð»Ð¸Ð·Ðµ. ÐÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½ Ð²ÑÐ±Ð¾Ñ Ð¾Ð±ÑÑÐ°ÑÑÐ¸Ñ Ð´Ð°Ð½Ð½ÑÑ. ÐÑÑÐ²Ð»ÐµÐ½Ñ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¸, Ð·Ð½Ð°ÑÐµÐ½Ð¸Ñ Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ¾Ð² ÐºÐ¾ÑÐ¾ÑÑÑ Ð² Ð½Ð°Ð¸Ð±Ð¾Ð»ÑÑÐµÐ¹ ÑÑÐµÐ¿ÐµÐ½Ð¸ Ð²Ð»Ð¸ÑÑÑ Ð½Ð° ÑÐµÐ·ÑÐ»ÑÑÐ°Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸. ÐÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÑ ÑÐ±Ð¾ÑÑÐ¸ÐºÐ° Ð´Ð°Ð½Ð½ÑÑ. ÐÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð° Ð·Ð°Ð´Ð°ÑÐ° Ð¿ÑÐµÐ´Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð´Ð°Ð½Ð½ÑÑ Ð² ÑÐ¸ÑÐ»ÐµÐ½Ð½ÑÐ¹ ÑÐ¾ÑÐ¼Ð°Ñ Ð´Ð»Ñ Ð¿Ð¾ÑÐ»ÐµÐ´ÑÑÑÐµÐ¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÑÑÑÐ¸Ð¼ Ð¼Ð¾Ð´ÑÐ»ÐµÐ¼. ÐÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÑÑÑÐµÐ³Ð¾ Ð¼Ð¾Ð´ÑÐ»Ñ. Ð ÑÐµÑÐ²ÐµÑÑÐ¾Ð¹ Ð³Ð»Ð°Ð²Ðµ Ð¿ÑÐ¸Ð²ÐµÐ´ÐµÐ½Ð¾ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð² Ð·Ð°Ð´Ð°ÑÐµ ÑÐµÑÐµÐ²ÑÑ Ð°ÑÐ°Ðº: DDoS Ð¸ PortScan. ÐÐ°Ð½Ð¾ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð·Ð°ÑÐ¸ÑÐ°ÐµÐ¼Ð¾Ð³Ð¾ ÑÐ·Ð»Ð°. ÐÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð¾ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ðµ Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐµÐ¼Ð¾Ð³Ð¾ Ð´Ð»Ñ Ð¼Ð¾Ð´ÐµÐ»Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ°Ðº Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ, Ð° ÑÐ°ÐºÐ¶Ðµ ÐµÐ³Ð¾ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ. ÐÐ¿Ð¸ÑÐ°Ð½Ð° Ð¿Ð¾ÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÐµÐ»ÑÐ½Ð¾ÑÑÑ Ð¿Ð¾Ð´Ð³Ð¾ÑÐ¾Ð²ÐºÐ¸ Ð´Ð°Ð½Ð½ÑÑ Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð°. ÐÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð½ÑÑ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ¾Ð².
description: This work relates to the field of information security. It is applicable, in particular, in the field of network attack detection. The first chapter classifies network attacks according to various criteria. The methods of influencing the protected system are highlighted. The basic methods of detecting network attacks are outlined, the advantages and disadvantages of the described methods are emphasized. The second chapter describes the machine learning algorithms used in solving classification problems. Advantages and disadvantages are highlighted. The third chapter defines the components of the system. The signs of network packets involved in the analysis are described. The training data has been selected. The signs whose parameter values have the greatest influence on the classification result have been identified. The architecture of the data collector has been developed. The task of preprocessing the data into a numerical format for subsequent classification by the analyzing module has been completed. The analysis module has been developed. The fourth chapter describes the network attacks set out in the task: DDoS and PortScan. The description of the protected node is given. The description of the software used to simulate attacks, as well as its application, is made. The sequence of data preparation to identify the effectiveness of the developed tool is described. The analysis of the conducted experiments was carried out.