Adaptive Anomaly Detection in the Behavior of Computer Systems Users on the Basis of Markov Chains of Variable Order. Part II. Anomaly Detection Methods and Experimental Results

Kussul, Nataliya N.; Sokolov, A. M.

doi:10.1615/jautomatinfscien.v35.i8.10

Cited by 1 publication

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The disadvantage of many neural networks is their poor fitness to process non-ordered datasets. Introducing an artificial order on a set of element values will only distort the picture, since the neural network will recalculate weights according to the proximity of numerical values; d) based on a finite automata (state machine) synthesis [6,9,18,19,20]. The main disadvantage of this approach is the complex process of building a state machine by parsing the attack scenario.…”

Section: Existing Approachesmentioning

confidence: 99%

“…Analysis of research results published in [3,4,5,6,7,8], as well as reports of major information security systems developers, showed that there is no single effective algorithm for denial-of-service attack detection and mitigation. Usually, vendows offer an expensive solution implementing a hybrid algorithm based on signature search methods and blacklisting attacker node IP addresses as a form of mitigation.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Machine-Synesthetic Approach to DDoS Network Attack Detection

Monakhov

Nikitin

Kuznetsova

et al. 2019

Advances in Intelligent Systems and Computing

View full text Add to dashboard Cite

In the authors opinion, anomaly detection systems, or ADS, seem to be the most perspective direction in the subject of attack detection, because these systems can detect, among others, the unknown (zero-day) attacks. To detect anomalies, the authors propose to use machine synesthesia. In this case, machine synesthesia is understood as an interface that allows using image classification algorithms in the problem of detecting network anomalies, making it possible to use non-specialized image detection methods that have recently been widely and actively developed. The proposed approach is that the network traffic data is projected into the image.It can be seen from the experimental results that the proposed method for detecting anomalies shows high results in the detection of attacks. On a large sample, the value of the complex efficiency indicator reaches 97%.

show abstract

Section: Existing Approachesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%