ПОИСК ИНФОРМАТИВНЫХ ПРИЗНАКОВ НА ОСНОВЕ МЕТОДА ГЛАВНЫХ КОМПОНЕНТ В ЗАДАЧАХ ИДЕНТИФИКАЦИИ И ОЦЕНКИ ВРЕДОНОСНОГО ТРАФИКА
DOI:
https://doi.org/10.52167/1609-1817-2024-132-3-406-418Ключевые слова:
вредоносный трафик, признаковое пространство, информативные признаки, метод главных компонент, избыточность данных, размерность, алгоритм, выборка сетевого трафика, предобработка данныхАннотация
Данное исследование направлено на повышение качественных показателей идентификации и оценки вредоносного трафика в корпоративных сетях. Одной из задач данного исследования является разработка модели признакового пространства сетевого трафика за счет выделения наиболее информативных признаков из кортежа значений сетевых пакетов. Так как анализ всего признакового пространства требует больших вычислительных затрат, а избыточность данных может приводить к переобучению модели, возникает необходимость в уменьшении размерности признакового пространства, путем выделения наиболее информативных и исключения менее информативных признаков. В статье описано применение метода главных компонент для задач выявления наиболее информативных признаков. Предложенный подход повышает надежность результатов идентификации и оценки вредоносного трафика.
Библиографические ссылки
[1] Danilov, V.V., Gerget, O.M., Kolpashchikov, D.Yu., Laptev, N.V., Manakov, R.A., Hérnandez-Gómez, L.A., Alvarez, F., (...), Ledesma-Carbayo, M.J. // Boosting segmentation accuracy of the deep learning models based on the synthetic data generation // (2021) International Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences - ISPRS Archives, 54 (2/W1), pp. 33-40.
[2] Kulambayev, B., Beissenova, G., Katayev, N., Abduraimova, B., Zhaidakbayeva, L., Sarbassova, A., Akhmetova, O., Shyrakbayev, A. // A Deep Learning-Based Approach for Road Surface Damage Detection // (2022) Computers, Materials and Continua, 73 (2), pp. 3403-3418. doi: 10.32604/cmc.2022.029544.
[3] Yuan Gao, Xianhui Yin, Zhen He, Xueqing Wang // A deep learning process anomaly detection approach with representative latent features for low discriminative and insufficient abnormal data //Computers & Industrial Engineering, Volume 176, 2023, 108936, ISSN 0360-8352, https://doi.org/10.1016/j.cie.2022.108936.
[4] Eduardo Weber Wächter, Server Kasap, Şefki Kolozali, Xiaojun Zhai, Shoaib Ehsan, Klaus D. McDonald-Maier, Using machine learning for anomaly detection on a system-on-chip under gamma radiation, Nuclear Engineering and Technology, Volume 54, Issue 11, 2022, Pages 3985-3995, ISSN 1738-5733, https://doi.org/10.1016/j.net.2022.06.028.
[5] Nassif, Ali & Abu Talib, Manar & Nasir, Qassim & Dakalbab, Fatima. (2021). Machine Learning for Anomaly Detection: A Systematic Review. IEEE Access. PP. 1-1. 10.1109/ACCESS.2021.3083060.
[6] Thudumu, S., Branch, P., Jin, J. et al. A comprehensive survey of anomaly detection techniques for high dimensional big data. J Big Data 7, 42 (2020). https://doi.org/10.1186/s40537-020-00320-x.
[7] Shim J, Koo J, Park Y, Kim J. Anomaly Detection Method in Railway Using Signal Processing and Deep Learning. Applied Sciences. 2022; 12(24):12901. https://doi.org/10.3390/app122412901.
[8] Omar, Salima & Ngadi, Md & Jebur, Hamid & Benqdara, Salima. (2013). Machine Learning Techniques for Anomaly Detection: An Overview. International Journal of Computer Applications. 79. 10.5120/13715-1478.
[9] Sukhoparov M. E., Lebedev I. S. Identification of the state of information security of Internet of Things devices in information and telecommunication systems // Control systems, communications and security. 2020. No. 3. pp. 252-268. DOI: 10.24411/2410-9916-2020-10310.
[10] Benjamin Staar, Michael Lütjen, Michael Freitag, Anomaly detection with convolutional neural networks for industrial surface inspection, Procedia CIRP, Volume 79, 2019, Pages 484-489, ISSN 2212-8271, https://doi.org/10.1016/j.procir.2019.02.123.
[11] AlDahoul, N., Abdul Karim, H. & Ba Wazir, A.S. Model fusion of deep neural networks for anomaly detection. J Big Data 8, 106 (2021). https://doi.org/10.1186/s40537-021-00496-w.
[12] J. E. D. Albuquerque Filho, L. C. P. Brandão, B. J. T. Fernandes and A. M. A. Maciel // A Review of Neural Networks for Anomaly Detection // IEEE Access, vol. 10, pp. 112342-112367, 2022, doi: 10.1109/ACCESS.2022.3216007.
[13] Naseer, Sheraz & Saleem, Dr. Yasir & Khalid, Shehzad & Khawar, Mr & Han, Jihun & Iqbal, Muhammad & Han, Kijun. (2018). Enhanced Network Anomaly Detection Based on Deep Neural Networks. IEEE Access. 6. 1-1. 10.1109/ACCESS.2018.2863036.
[14] Elfaki, Abdelrahman. (2014). Using a Rule-based Method for Detecting Anomalies in Software Product Line. Research Journal of Applied Sciences, Engineering and Technology. 7.
[15] N. Duffield, P. Haffner, B. Krishnamurthy and H. Ringberg // Rule-Based Anomaly Detection on IP Flows // IEEE INFOCOM 2009, Rio de Janeiro, Brazil, 2009, pp. 424-432, doi: 10.1109/INFCOM.2009.5061947.
[16] Szmit, Maciej & Wężyk, Radosław & Skowroński, Maciej & Szmit, Anna. (2007). TRAFFIC ANOMALY DETECTION WITH SNORT.
[17] Iglesias Vázquez, Félix & Zseby, Tanja. (2014). Analysis of network traffic features for anomaly detection. Machine Learning. 101. 10.1007/s10994-014-5473-9.
[18] Liu H, Wang H. Real-Time Anomaly Detection of Network Traffic Based on CNN. Symmetry. 2023; 15(6):1205. https://doi.org/10.3390/sym15061205.
[19] Zhang M, Guo J, Li X, Jin R. Data-Driven Anomaly Detection Approach for Time-Series Streaming Data. Sensors (Basel). 2020 Oct 2;20(19):5646. doi: 10.3390/s20195646. PMID: 33023175; PMCID: PMC7582627.
[20] Zhou, Zeng-Guang & Tang, Ping. (2016). Improving time series anomaly detection based on exponentially weighted moving average (EWMA) of season-trend model residuals. 10.1109/IGARSS.2016.7729882.
[21] Tang H, Wang Q, Jiang G. Time Series Anomaly Detection Model Based on Multi-Features. Comput Intell Neurosci. 2022 Aug 8;2022:2371549. doi: 10.1155/2022/2371549. PMID: 35978905; PMCID: PMC9377841.
[22] Zheng, J., Li, J., Liu, C. et al. Anomaly detection for high-dimensional space using deep hypersphere fused with probability approach. Complex Intell. Syst. 8, 4205–4220 (2022). https://doi.org/10.1007/s40747-022-00695-9.
[23] Stephen Ranshous, Shitian Shen, Danai Koutra, SteveHarenberg, Christos Faloutsos, Nagiza F. Samatova Anomaly detection in dynamic networks: a survey WIREs Comput Stat2015, 7:223–247. doi: 10.1002/wics.1347.
[24] Y. Purwanto, Kuspriyanto, Hendrawan and B. Rahardjo, "Traffic anomaly detection in DDos flooding attack," 2014 8th International Conference on Telecommunication Systems Services and Applications (TSSA), Kuta, Bali, Indonesia, 2014, pp. 1-6, doi: 10.1109/TSSA.2014.7065953.
[25] Haiping Lin, Chengwen Wu, Mohammad Masdari A comprehensive survey of network traffic anomalies and DDoS attacks detection schemes using fuzzy techniques, Computers and Electrical Engineering, Volume 104, Part B, 2022, 108466, ISSN 0045-7906, https://doi.org/10.1016/j.compeleceng.2022.108466.
[26] Purwanto, Yudha & Kuspriyanto, & Hendrawan, Temmy & Rahardjo, Budi. (2015). Traffic anomaly detection in DDos flooding attack. Proceedings of 2014 8th International Conference on Telecommunication Systems Services and Applications, TSSA 2014. 10.1109/TSSA.2014.7065953.
[27] Chovanec M, Hasin M, Havrilla M, Chovancová E. Detection of HTTP DDoS Attacks Using NFStream and TensorFlow. Applied Sciences. 2023; 13(11):6671. https://doi.org/10.3390/app13116671.
[28] Lopez, Alma D.; Mohan, Asha P.; and Nair, Sukumaran (2019) "Network Traffic Behavioral Analytics for Detection of DDoS Attacks," SMU Data Science Review: Vol. 2: No. 1, Article 14.
[29] Zhao, David & Traore, Issa & Sayed, Bassam & Lu, Wei & Saad, Sherif & Ghorbani, Ali & Garant, Dan. (2013). Botnet detection based on traffic behavior analysis and flow intervals. Computers & Security. 39. 2–16. 10.1016/j.cose.2013.04.007.
[30] Alaa Obeidat, Rola Yaqbeh, "Smart Approach for Botnet Detection Based on Network Traffic Analysis", Journal of Electrical and Computer Engineering, vol. 2022, Article ID 3073932, 10 pages, 2022. https://doi.org/10.1155/2022/3073932.
[31] Manmeet Singh, Maninder Singh, Sanmeet Kaur, Issues and challenges in DNS based botnet detection: A survey, Computers & Security, Volume 86, 2019, Pages 28-52, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2019.05.019.
[32] Craig A. Schiller, Jim Binkley, David Harley, Gadi Evron, Tony Bradley, Carsten Willems, Michael Cross, Chapter 5 - Botnet Detection: Tools and Techniques, 2007, Pages 133-215, ISBN 9781597491358, https://doi.org/10.1016/B978-159749135-8/50007-X.
[33] Lindsay I Smith A tutorial on Principal Components Analysis. Department of Computer Science, University of Otago, New Zealand. http://www.cs.otago.ac.nz/research/techreports.php
Загрузки
Опубликован
Как цитировать
Выпуск
Раздел
Лицензия
Copyright (c) 2024 Shaikhanova Aigul
Это произведение доступно по лицензии Creative Commons «Attribution-NonCommercial-NoDerivatives» («Атрибуция — Некоммерческое использование — Без производных произведений») 4.0 Всемирная.
