MODELING OF INFORMATION AND COMMUNICATION NETWORK TRAFFIC USING BLOCK-ORIENTED STRUCTURES FOR ATTACK DETECTION SYSTEMS

Abstract

It was established that the current task is to build adequate predictive models of network self-similar traffic, which would allow their use in IDS for detecting network anomalies in real time with sufficient efficiency in terms of errors and reliability and increased efficiency. At the same time, predicting network self-similar traffic allows to increase the efficiency of attack detection. It is proposed to use intelligent adaptive approximator filters for predicting information and communication network traffic, which are built on the basis of block-oriented Wiener, Hammerstein models and their combinations. Network traffic modeling using block-oriented structures was carried out in the Matlab environment based on experimental data – traffic transmitted via the Internet. The criterion of unbiasedness (minimum shift) was used as a criterion for evaluating models. The types of structures considered were Wiener, Hammerstein, Hammerstein-Wiener models and autoregression with an additional input signal. Wavenet, forward propagation neural networks, decision tree, linear functions, Kolmogorov-Gabor polynomial, saturation and dead zone were used as basic functions. As a result of the modeling, it was found that the advantage (in the sense of the minimum shift criterion) is given to block- oriented Hammerstein-Wiener models with intelligent basis functions – a sigmoidal neural network and a wavenet. For other studied block-oriented models, intelligent basis functions are also preferred. The adequacy of the obtained models of network self-similar traffic to experimental data was checked and confirmed by the non-parametric sign criterion.Further research should be aimed at substantiating and studying the informativeness of the characteristics and traffic models of information and communication networks, as well as the effectiveness of the criteria and methods for recognizing attacks. Conclusions. The effectiveness of using block-oriented structures and intelligent basis functions of the sought- after models of network self-similar traffic in solving the problem of its prediction is proven.