Anomaly-based Intrusion Detection in Computer Networks Using Machine Learning Techniques

Abstract

The relevance of this paper is based on the need to detect malicious activity and intrusions into a network or device as part of countermeasures and suppression of cyberattacks and cybercrime. The software proposed is a network-level intrusion detection system that uses an anomalous approach to interpret network traffic and passive response and data retrieval modes. The architecture of the proposed network-based intrusion detection system contains a module for listening to transmitted and received data packets and storing the data as a dataset, an analysis and response module, and a user interface module. In the course of development, we prepared data for further training of the system and determined the mechanisms of data formation in the selected training dataset. Based on the studied mechanisms, we implemented an algorithm for listening to network packets and forming a new test dataset. Common machine learning algorithms were applied in the analysis and response module that contains a handler and allows the user to select and run the desired machine learning algorithm. To evaluate the quality of classification algorithms, network attacks on protected computer networks were simulated. We conducted testing on a balanced dataset, in a network that was free of network attacks, while pre-trained algorithms were tested in a network with and without network attacks. The pre-trained algorithms showed acceptably high accuracy results.