ARCHITECTURE OF A MULTI-AGENT INTRUSION DETECTION SYSTEM BASED ON MACHINE LEARNING

Abstract

The article addresses the problem of building an effective intrusion detection system in cloud and distributed environments based on a multi-agent architecture using machine learning methods. The relevance of the study is driven by the rapid development of cloud technologies, the growing number and complexity of cyber threats, and the increased requirements for the continuity and security of distributed information systems. The limitations of traditional signaturebased approaches are demonstrated, as they largely depend on timely updates of rule databases and show insufficient effectiveness in detecting new or modified attacks. The proposed approach combines a signature-based mechanism for analyzing known threats with behavioral modeling based on machine learning methods. This integration enables the detection of both known attacks and unknown zero-day incidents by identifying statistically significant deviations from the established baseline profiles of system and user behavior in real time. A distinctive feature of the work is the formation of two complementary models: the user behavior profile and the overall system functioning profile. To construct these models, a specialized dataset of normal system operation was created, reflecting typical cloud infrastructure usage scenarios and characteristic workload parameters. This approach makes it possible to account for the specifics of a particular environment, improve detection accuracy, reduce the number of false positives, and ensure system adaptability to changing operating conditions. The architecture of the solution is based on a multi-agent approach with functional distribution among intelligent agents that perform data collection, preprocessing, analytical interpretation of events, alert generation, and adaptive knowledge base updating. The implementation of a multi-level structure ensures scalability, configuration flexibility, fault tolerance, and the possibility of integration with existing cloud infrastructure monitoring systems. The obtained experimental results confirm the effectiveness of the proposed model in improving the cybersecurity level of cloud services and ensuring timely detection of cyber incidents