Network Attack Recognition Using Fuzzy Logic

Abstract

The following research paper presents a fuzzy logic system model related to classifying network traffic as malicious or normal. The relevance of the problem stems from the increasingly widespread worldwide problem, namely cyber threats against various companies, organizations, individuals, etc. and at the same time the use of artificial intelligence systems as a means of detecting and preventing various types of cybercrime. To accomplish the task, several basic work methods are followed: first, the development goal is defined - building a fuzzy logic system that supports and automates decision-making about the type of network traffic (malicious or normal traffic), second, appropriate software is selected to perform the task, in this case MATLAB and specifically the Fuzzy Logic Designer toolbox, third, the actual system is built consisting of pre-obtained network traffic inputs that are taken from a pre-collected and compiled .pcap file (the data in it are captured and modified to contain only some network information fields from the set of packets necessary for the experiment to run successfully), the system itself consists of nine input linguistic variables, one output linguistic variable and a knowledge base (the core of the project, namely if-then rules). The studied system is compared with other similar fuzzy output systems of other researchers. Based on this, it is concluded that the approach proposed in the present work to categorize network traffic, based on pre-selected network information fields, in collaboration with other means of cyber protection gives very good results in the context of cyber security. The present project proposes a fuzzy inference system to classify network packet types and detect TCP-SYN attack. The fully built fuzzy source system provides a different perspective to solve the present problem by defining the abstract solution and facilitating the work of specialized personnel charged with such tasks by automating the process of providing an adequate solution regarding the legitimacy of network traffic.