ATTACK DETECTION IN ENTERPRISE NETWORKS BY MACHINE LEARNING METHODS

Современные информационные технологии и IT-образование

Artem A. Matveev¹  Aleksandr E. Shukhman¹  Petr N. Polezhaev¹  Yuri A. Ushakov¹  Nadezhda F. Bakhareva²  Veniamin N. Tarasov² 

[1] Orenburg State University, Orenburg, Russia;Povolzhskiy State University of Telecommunications & Informatics, Samara, Russia;

关键词: Protection of enterprise networks;    traffic analysis;    classification;    machine learning;    detection of attacks;   

DOI  :  10.25559/SITITO.14.201803.626-632

来源: DOAJ

【 摘 要 】

Detection of network attacks is currently one of the most important problems of secure use ofenterprise networks. Network signature-based intrusion detection systems cannot detect new types of attacks. Thus, the urgent task is to quickly classify network traffic to detect network attacks. The article describes algorithms for detecting attacks in enterprise networks based on data analysis that can be collected in them. The UNSW-NB15 data set was used to compare machine learning methods for classifying attack or-normal traffic, as well as to identify nine more popular classes of typical attacks, such as Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms. Balanced accuracy is used as the main metric for assessing the accuracy of the classification. The main advantage of this metric is an adequate assessment of the accuracy of classification algorithms given the strong imbalance in the number of marked records for each class of data set. As a result of the experiment, it was found that the best algorithm for identifying the presence of an attack is RandomForest, to clarify its type - AdaBoost.

【 授权许可】

Unknown