## 1 Introduction  
In modern society, the role of information technology is constantly growing, as it makes our lives more convenient. These technologies have become firmly established not only in our everyday life but also in almost all spheres of human activity: economic, managerial, social, industrial, scientific, etc. However, along with undeniable advantages, these technologies bring new problems locally and globally. The number of crimes in the field of information technology is growing rapidly [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25]. Cyberattacks carry a wide range of malicious impacts from the most harmless, such as displaying a manner or playing a sound signal on a local machine, to stealing the confidential data of millions of people. This makes the problem of ensuring information security extremely important [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25]. There are many software and hardware tools for ensuring the cybersecurity of information systems, an important place among which is occupied by intrusion detection systems (IDS) [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25]. In modern literature, much attention is paid to the principles of functioning of such systems. In the most general form, intrusion detection systems can be divided into two classes: signature-based intrusion detection systems (SIDS) and anomaly-based intrusion detection systems (AIDS). The operation of SIDS is based on comparing the current state of a controlled object, for example, a local computer or a network segment, with some sample (signature) of a previously known attack [2; 6; 7; 8; 9]. Such signatures are sequences of commands, actions that were previously identified as an intrusion. Traditional SIDS inspect network packets and attempt to match them against a signature database that is generated by the IDS developer based on analysis of known intrusions into information systems. Of course, such databases are constantly updated with new signatures, but their major drawback is the ability to detect only known intrusions. They are immune to new, unknown types of attacks. AIDS have become very popular due to their ability to detect so-called zero-day attacks, i.e., attacks for which signatures cannot be extracted [2; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23]. These are new types of attacks or attacks using polymorphic technologies, encryption, etc. In AIDS, a \"normal\" model of information system behavior is formed. Any unacceptable deviation between the behavior of the controlled object and the \"normal\" model is regarded as an anomaly, which can be interpreted as an intrusion. Intrusion detection methods in AIDS can be divided into three main groups: methods based on statistics, knowledge-based methods, and machine learning-based methods. Methods based on statistics include the collection of statistical data and the construction of a model of the \"normal\" behavior of the information system [2; 15; 16]. Knowledge-based methods use information about installed software, current protocols, allowed TCP ports, and so on [2; 17; 18]. Machine learning methods involve the use of complex neural network algorithms, clustering, genetic algorithms, etc. [2; 4; 19; 20; 21; 22; 23]. In AIDS, the Kalman filter can be used to detect anomalies [24; 25]. The article [24] states that new types of attacks have been appearing recently, and traditional approaches of detecting them using methods based on statistics are not always effective. The same article presents a method for detecting anomalies based on the use of the Kalman filter. This method proved to be much more effective than traditional methods. The article [25] provides an effective method for using Kalman filtering in hierarchically distributed intrusion detection systems.