ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2024-24-5-788-796ntv-147Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEРасширенное обнаружение аномалий в сетевой безопасности: комплексный ансамблевый подходEnhanced anomaly detection in network security: a comprehensive ensemble approachhttps://orcid.org/0000-0003-0042-6565ПандейР.PandeyR.

Пандей Рашмикиран - аспирант, Московский физико-технический институт (национальный исследовательский университет)

Московская область, Долгопрудный, 141701

Rashmikiran Pandey - PhD Student

Moscow region, Dolgoprudny, 141701

rashmikiran@phystech.eduhttps://orcid.org/0009-0009-5151-6908ПандейМ.PandeyM.

Пандей Мринал - аспирант

Московская область, Долгопрудный, 141701

Mrinal Pandey - PhD Student, Moscow Institute of Physics and Technology (National Research University)

Moscow region, Dolgoprudny, 141701

mrinalpandei@phystech.eduhttps://orcid.org/0000-0002-0497-0296НазаровА. Н.NazarovA. N.

Назаров Алексей Николаевич - доктор технических наук, профессор

Москва, 119333

Alexey N. Nazarov - D.Sc., Professor

Moscow, 119333

a.nazarov06@bk.ruМосковский физико-технический институт (национальный исследовательский университет)РоссияMoscow Institute of Physics and Technology (National Research University)Russian FederationФедеральный исследовательский центр «Информатика и управление» Российской академии наук»РоссияFederal Research Center “Computer Science and Control” of the Russian Academy of SciencesRussian Federation202413122024245788796Copyright © Пандей Р., Пандей М., Назаров А.Н., 20242024Пандей Р., Пандей М., Назаров А.Н.Pandey R., Pandey M., Nazarov A.N.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/147

Обнаружение и устранение аномального поведения сетевых систем являются важнейшими мерами по обеспечению безопасности уязвимых инфраструктур в динамичном контексте кибербезопасности. Предложена архитектура модели машинного обучения ensemble, которая использует преимущества моделей XGBoost, Gradient Boosting, случайного леса и метода опорных векторов для выявления аномалий в наборе данных. Представленный подход использует совокупность перечисленных моделей с взвешенным голосованием и основан на точности, для улучшения обнаружения аномалий и обеспечения надежной и адаптивной сетевой безопасности в реальном времени. Модель коллективного обучения оценивается по стандартным показателям и демонстрирует исключительную эффективность, достигая высокой точности 99,68 % в наборе данных NSL KDD. Высокая производительность подхода расширяет возможности модели в выявлении аномалий в сетевом трафике, демонстрирует ее потенциал в качестве надежного инструмента для усиления мер кибербезопасности против развивающихся угроз.

Detection and handling of anomalous behavior in the network systems are peremptory efforts to ensure security for vulnerable infrastructures amidst the dynamic context of cybersecurity. In this paper, we propose an ensemble machine learning model architecture that leverages the strengths of XGBoost, Gradient Boosting, Random Forest, and Support Vector Machine models to identify anomalies in the dataset. This method utilizes an ensemble of these models with weighted voting based on accuracy to enhance anomaly detection for robust and adaptive real-world network security. The proposed ensemble learning model is evaluated on standard metrics and demonstrates exceptional efficacy, achieving an impressive accuracy of 99.68 % on NSL KDD dataset. This remarkable performance extends the model prowess in discerning anomalies within network traffic showcasing its potential as a robust tool for enhancing cybersecurity measures against evolving threats.

обнаружение аномалийпакетирование и бустинггрупповой подходсетевая безопасностьнейронная сетьanomaly detectionbagging and boostingensemble approachnetwork securityneural networkReferencesReichenbach M. New challenges in electronic payments. Intelligent Enterprises of the 21st Century. Ed. by J.N.D. Gupta, S. Sharma. IGI Global, 2004, pp. 153–162. https://doi.org/10.4018/9781591401605.ch010Reichenbach M. New challenges in electronic payments // Intelligent Enterprises of the 21st Century / ed. by J.N.D. Gupta, S. Sharma. IGI Global, 2004. P. 153–162. https://doi.org/10.4018/9781591401605.ch010Kebande V.R., Karie N.M., Ikuesan R.A. Real-time monitoring as a supplementary security component of vigilantism in modern network environments. International Journal of Information Technology, 2021, vol. 13, no. 1, pp. 5–17. https://doi.org/10.1007/s41870-020-00585-8Kebande V.R., Karie N.M., Ikuesan R.A. Real-time monitoring as a supplementary security component of vigilantism in modern network environments // International Journal of Information Technology. 2021. V. 13. N 1. P. 5–17. https://doi.org/10.1007/s41870-020-00585-8Hareesh R., Senthil Kumar R.K., Kalluri R., Bindhumadhava B.S. Critical infrastructure asset discovery and monitoring for cyber security. Lecture Notes in Electrical Engineering, 2022, vol. 847, pp. 289–300. https://doi.org/10.1007/978-981-16-9008-2_27Hareesh R., Senthil Kumar R.K., Kalluri R., Bindhumadhava B.S. Critical infrastructure asset discovery and monitoring for cyber security // Lecture Notes in Electrical Engineering. 2022. V. 847. P. 289–300. https://doi.org/10.1007/978-981-16-9008-2_27Savage D., Zhang X., Yu X., Chou P., Wang Q. Anomaly detection in online social networks. Social Networks, 2014, vol. 39, pp. 62–70. https://doi.org/10.1016/j.socnet.2014.05.002Savage D., Zhang X., Yu X., Chou P., Wang Q. Anomaly detection in online social networks // Social Networks. 2014. V. 39. P. 62–70. https://doi.org/10.1016/j.socnet.2014.05.002Benaddi H., Ibrahimi K., Benslimane A. Improving the intrusion detection system for NSL-KDD dataset based on PCA-fuzzy clustering-KNN. Proc. of the 6th International Conference on Wireless Networks and Mobile Communications (WINCOM), 2018, pp. 1–6. https://doi.org/10.1109/wincom.2018.8629718Benaddi H., Ibrahimi K., Benslimane A. Improving the intrusion detection system for NSL-KDD dataset based on PCA-fuzzy clustering-KNN // Proc. of the 6th International Conference on Wireless Networks and Mobile Communications (WINCOM). 2018. P. 1–6. https://doi.org/10.1109/wincom.2018.8629718Su T., Sun H., Zhu J., Wang S., Li Y. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset. IEEE Access, 2020, vol. 8, pp. 29575–29585. https://doi.org/10.1109/access.2020.2972627Su T., Sun H., Zhu J., Wang S., Li Y. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset // IEEE Access. 2020. V. 8. P. 29575–29585. https://doi.org/10.1109/access.2020.2972627Wang C., Zhou H., Hao Z., Hu S., Li J., Zhang X., Jiang B., Chen X. Network traffic analysis over clustering-based collective anomaly detection. Computer Networks, 2022, vol. 205, pp. 108760. https://doi.org/10.1016/j.comnet.2022.108760Wang C., Zhou H., Hao Z., Hu S., Li J., Zhang X., Jiang B., Chen X. Network traffic analysis over clustering-based collective anomaly detection // Computer Networks. 2022. V. 205. P. 108760. https://doi.org/10.1016/j.comnet.2022.108760Keim Y., Mohapatra A.K. Cyber threat intelligence framework using advanced malware forensics. International Journal of Information Technology, 2022, vol. 14, no. 1, pp. 521–530. https://doi.org/10.1007/s41870-019-00280-3Keim Y., Mohapatra A.K. Cyber threat intelligence framework using advanced malware forensics // International Journal of Information Technology. 2022. V. 14. N 1. P. 521–530. https://doi.org/10.1007/s41870-019-00280-3Xu B., Jang-Jaccard J., Singh A., Wei Y., Sabrina F. Improving performance of autoencoder-based network anomaly detection on nsl-kdd dataset. IEEE Access, 2021, vol. 9, pp. 140136–140146. https://doi.org/10.1109/access.2021.3116612Xu B., Jang-Jaccard J., Singh A., Wei Y., Sabrina F. Improving performance of autoencoder-based network anomaly detection on nsl-kdd dataset // IEEE Access. 2021. V. 9. P. 140136–140146. https:// doi.org/10.1109/access.2021.3116612Shone N., Ngoc T.N., Phai V.D., Shi Q. A deep learning approach to network intrusion detection. IEEE Transactions on Emerging Topics in Computational Intelligence, 2018, vol. 2, no. 1, pp. 41–50. https:// doi.org/10.1109/tetci.2017.2772792Shone N., Ngoc T.N., Phai V.D., Shi Q. A deep learning approach to network intrusion detection // IEEE Transactions on Emerging Topics in Computational Intelligence. 2018. V. 2. N 1. P. 41–50. https://doi.org/10.1109/tetci.2017.2772792Sharma B., Sharma L., Lal C. Anomaly based network intrusion detection for IoT attacks using convolution neural network. Proc. of the IEEE 7th International Conference for Convergence in Technology (I2CT), 2022, pp. 1–6. https://doi.org/10.1109/i2ct54291.2022.9824229Sharma B., Sharma L., Lal C. Anomaly based network intrusion detection for IoT attacks using convolution neural network // Proc. of the IEEE 7th International Conference for Convergence in Technology (I2CT). 2022. P. 1–6. https://doi.org/10.1109/i2ct54291.2022.9824229Krzemień W., Jędrasiak K., Nawrat A. Anomaly detection in software defined networks using ensemble learning. Lecture Notes in Networks and Systems, 2022, vol. 439, pp. 629–643. https://doi.org/10.1007/978-3-030-98015-3_44Krzemień W., Jędrasiak K., Nawrat A. Anomaly detection in software defined networks using ensemble learning // Lecture Notes in Networks and Systems. 2022. V. 439. P. 629–643. https://doi.org/10.1007/978-3-030-98015-3_44Staudemeyer R.C. Applying long short-term memory recurrent neural networks to intrusion detection. South African Computer Journal, 2015, vol. 56, pp. 136–154. https://doi.org/10.18489/sacj.v56i1.248Staudemeyer R.C. Applying long short-term memory recurrent neural networks to intrusion detection // South African Computer Journal. 2015. V. 56. P. 136–154. https://doi.org/10.18489/sacj.v56i1.248Kim J., Kim J., Thu H.L.T., Kim H. Long short term memory recurrent neural network classifier for intrusion detection. Proc. of the International Conference on Platform Technology and Service (PlatCon), 2016, pp. 1–5.https://doi.org/10.1109/platcon.2016.7456805Kim J., Kim J., Thu H.L.T., Kim H. Long short term memory recurrent neural network classifier for intrusion detection // Proc. of the International Conference on Platform Technology and Service (PlatCon). 2016. P. 1–5. https://doi.org/10.1109/platcon.2016.7456805Liu Z., Thapa N., Shaver A., Roy K., Yuan X., Khorsandroo S. Anomaly detection on IoT network intrusion using machine learning. Proc. of the International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (ICABCD), 2020, pp. 1–5. https://doi.org/10.1109/icabcd49160.2020.9183842Liu Z., Thapa N., Shaver A., Roy K., Yuan X., Khorsandroo S. Anomaly detection on IoT network intrusion using machine learning // Proc. of the International Conference on Artificial Intelligence, Big Data, Computing and Data Communication Systems (ICABCD). 2020. P. 1–5. https://doi.org/10.1109/icabcd49160.2020.9183842Khan W., Haroon M. An unsupervised deep learning ensemble model for anomaly detection in static attributed social networks. International Journal of Cognitive Computing in Engineering, 2022, vol. 3, pp. 153–160. https://doi.org/10.1016/j.ijcce.2022.08.002Khan W., Haroon M. An unsupervised deep learning ensemble model for anomaly detection in static attributed social networks // International Journal of Cognitive Computing in Engineering. 2022. V. 3. P. 153–160. https://doi.org/10.1016/j.ijcce.2022.08.002Gupta K., Sharma D.K., Gupta K.D., Kumar A. A tree classifier based network intrusion detection model for Internet of Medical Things. Computers and Electrical Engineering, 2022, vol. 102, pp. 108158. https://doi.org/10.1016/j.compeleceng.2022.108158Gupta K., Sharma D.K., Gupta K.D., Kumar A. A tree classifier based network intrusion detection model for Internet of Medical Things // Computers and Electrical Engineering. 2022. V. 102. P. 108158. https://doi.org/10.1016/j.compeleceng.2022.108158Ma Q., Sun C., Cui B. A novel model for anomaly detection in network traffic based on support vector machine and clustering. Security and Communication Networks, 2021, pp. 170788. https://doi.org/10.1155/2021/2170788Ma Q., Sun C., Cui B. A novel model for anomaly detection in network traffic based on support vector machine and clustering // Security and Communication Networks. 2021. P. 170788. https://doi.org/10.1155/2021/2170788Iliyasu A.S., Deng H. N-GAN: a novel anomaly-based network intrusion detection with generative adversarial networks. International Journal of Information Technology, 2022, vol. 14, no. 7, pp. 3365–3375. https://doi.org/10.1007/s41870-022-00910-3Iliyasu A.S., Deng H. N-GAN: a novel anomaly-based network intrusion detection with generative adversarial networks // International Journal of Information Technology. 2022. V. 14. N 7. P. 3365–3375. https://doi.org/10.1007/s41870-022-00910-3Tavallaee M., Bagheri E., Lu W., Ghorbani A.A. A detailed analysis of the KDD CUP 99 data set. Proc. of the IEEE Symposium on Computational Intelligence for Security and Defense Applications, 2009, pp. 1–6. https://doi.org/10.1109/cisda.2009.5356528Tavallaee M., Bagheri E., Lu W., Ghorbani A.A. A detailed analysis of the KDD CUP 99 data set // Proc. of the IEEE Symposium on Computational Intelligence for Security and Defense Applications. 2009. P. 1–6. https://doi.org/10.1109/cisda.2009.5356528Panesar A. Evaluating machine learning models. Machine Learning and AI for Healthcare. Apress, Berkeley, CA, 2021, pp. 189–205. https://doi.org/10.1007/978-1-4842-6537-6_7Panesar A. Evaluating machine learning models // Machine Learning and AI for Healthcare. Apress, Berkeley, CA, 2021. P. 189–205. https://doi.org/10.1007/978-1-4842-6537-6_7Assy A.T., Mostafa Y., Abd El-khaleq A., Mashaly M. Anomaly-based intrusion detection system using one-dimensional convolutional neural network. Procedia Computer Science, 2023, vol. 220, pp. 78–85. https://doi.org/10.1016/j.procs.2023.03.013Assy A.T., Mostafa Y., Abd El-khaleq A., Mashaly M. Anomaly-based intrusion detection system using one-dimensional convolutional neural network // Procedia Computer Science. 2023. V. 220. P. 78–85. https://doi.org/10.1016/j.procs.2023.03.013Acharya T., Annamalai A., Chouikha M.F. Efficacy of bidirectional LSTM model for network-based anomaly detection. Proc. of the IEEE 13th Symposium on Computer Applications & Industrial Electronics (ISCAIE), 2023, pp. 336–341. https://doi.org/10.1109/iscaie57739.2023.10165336Acharya T., Annamalai A., Chouikha M.F. Efficacy of bidirectional LSTM model for network-based anomaly detection // Proc. of the IEEE 13th Symposium on Computer Applications & Industrial Electronics (ISCAIE). 2023. P. 336–341. https://doi.org/10.1109/iscaie57739.2023.10165336Kavitha S., Uma Maheswari N., Venkatesh R. Network anomaly detection for NSL-KDD dataset using deep learning. Information Technology in Industry, 2021, vol. 9, no. 2, pp. 821–827. https://doi.org/10.17762/itii.v9i2.419Kavitha S., Uma Maheswari N., Venkatesh R. Network anomaly detection for NSL-KDD dataset using deep learning // Information Technology in Industry. 2021. V. 9. N 2. P. 821–827. https://doi.org/10.17762/itii.v9i2.419Gadal S., Mokhtar R., Abdelhaq M., Alsaqour R., Ali E.S., Saeed R. Machine learning-based anomaly detection using K-mean array and sequential minimal optimization. Electronics, 2022, vol. 11, no. 14, pp. 2158. https://doi.org/10.3390/electronics11142158Gadal S., Mokhtar R., Abdelhaq M., Alsaqour R., Ali E.S., Saeed R. Machine learning-based anomaly detection using K-mean array and sequential minimal optimization // Electronics. 2022. V. 11. N 14. P. 2158. https://doi.org/10.3390/electronics11142158

The authors declare that there are no conflicts of interest present.