ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2026-26-2-315-323ntv-593Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEОбнаружение сетевых аномалий в среде Интернета вещей с использованием модифицированных статистических критериев и ансамблевых методовDetection of network anomalies in the Internet of Things environment using modified statistical criteria and ensemble methodshttps://orcid.org/0009-0009-4820-6132БажаевН.BazhayevN.

Бажаев Нуржан — постдокторант; главный инженер-программист

Астана, 010008

Астана, 010017

sc 57170793200

Nurzhan Bazhayev — Postdoctoral Researcher; Chief SoftwareEngineer

Astana, 010008

Astana, 010017

sc 57170793200

nurzhan_nfs@hotmail.comЕвразийский национальный университет имени Л. Н. Гумилёва; АО «Государственная техническая служба»КазахстанL.N. Gumilyov Eurasian National University; Joint Stock Company “State Technical Service”Kazakhstan202620042026262315323Copyright © Бажаев Н., 20262026Бажаев Н.Bazhayev N.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/593

Введение. Рост числа устройств Интернета вещей (Internet of Things, IoT) сопровождается усложнением угроз безопасности, включая атаки типа Distributed Denial of Service, brute-force авторизации и массовую генерацию пакетов. Традиционные статистические методы обнаружения аномалий показывают низкую устойчивость к шуму и не учитывают динамику трафика. Это приводит к росту числа ложноположительных срабатываний и снижению точности идентификации атак. Метод. Предложен гибридный подход к обнаружению аномалий в IoT-трафике, включающий три этапа: предварительную фильтрацию подозрительных пакетов с использованием модифицированной Z-оценки с учетом размера выборки; адаптивную вероятностную оценку риска атаки на основе байесовского классификатора с весовой функцией, усиливающей влияние значимых отклонений; финальную классификацию с применением ансамбля моделей (Random Forest, Support Vector Machine и Long Short-Term Memory), обеспечивающего устойчивость к шуму и выявление нелинейных зависимостей в данных. Основные результаты. Экспериментальная проверка на наборе данных UNSW-NB15, содержащем как нормальный трафик, так и различные типы атак, показала, что предложенный метод достигает Precision = 89,1 %, Recall = 90,3 % и F1-score = 89,9 %. Наилучшие результаты отмечены при анализе временных интервалов сообщений (до 92 % точности), что подтверждает эффективность временных признаков. Метод превзошел классические алгоритмы (Rosner Test, Holt-Winters) и сопоставим по точности с autoencoder, но требует меньших вычислительных ресурсов. Обсуждение. Гибридная архитектура позволяет адаптироваться к различным типам атак и снижает количество ложных тревог за счет сочетания статистической фильтрации и ансамблевой классификации. Устойчивость к шуму и низкая вычислительная сложность делают метод применимым в условиях ограниченных ресурсов IoT-устройств. Перспективы дальнейших исследований будут направлены на интеграцию федеративного обучения для децентрализованного анализа и использования самоподстраивающихся нейросетевых архитектур для прогнозирования сложных сценариев атак.

The rapid growth of Internet of Things (IoT) devices is accompanied by increasingly sophisticated security threats, including DDoS attacks, brute-force authentication attempts, and large-scale packet flooding. Traditional statistical methods for anomaly detection exhibit low robustness to noise and fail to account for the dynamic nature of IoT traffic. This results in a higher rate of false positives and reduced accuracy in attack identification. This paper proposes a hybrid approach to IoT traffic anomaly detection consisting of three stages: preliminary filtering of suspicious packets using a modified Z-score adjusted for sample size; adaptive probabilistic attack risk assessment based on a Bayesian classifier with a weighting function that amplifies the impact of significant deviations; final classification using an ensemble of models (Random Forest, SVM, and LSTM), which ensures robustness to noise and enables the identification of nonlinear dependencies in the data. Experimental evaluation on the UNSW-NB15 dataset, which includes both normal traffic and diverse attack scenarios, demonstrated that the proposed method achieved Precision = 89.1 %, Recall = 90.3 %, and F1-score = 89.9 %. The best results were observed in the analysis of message interval anomalies (up to 92 % accuracy), confirming the effectiveness of temporal features. The method outperformed classical algorithms (Rosner Test, Holt- Winters) and achieved comparable accuracy to autoencoder while requiring significantly fewer computational resources. The hybrid architecture enables adaptation to diverse attack types and reduces false alarms through the combination of statistical filtering and ensemble classification. Its noise resilience and low computational complexity make the method suitable for deployment in resource-constrained IoT environments. Future research directions include the integration of federated learning for decentralized anomaly detection and the use of self-adaptive neural architectures for predicting complex attack scenarios.

информационная безопасностьсети Интернета вещейобнаружение аномалийвыявление атакмодифицированная Z-оценкабайесовский классификаторансамблевое обучениемашинное обучениемониторинг трафикаinformation securityIoT securityIoT networksanomaly detectionintrusion detectionmodified Z-scoreBayesian classifierensemble learningmachine learningtraffic monitoringРабота выполнена при финансовой поддержке Комитета науки Министерства науки и высшего образования Республики Казахстан (грант № AP25794699).This research has been funded by the Committee of Science of the Ministry of Science and Higher Education of the Republic of Kazakhstan (Grant No. AP25794699).ReferencesStetsiuk M., Anikin V., Pyrch O., Kozelskiy O., Salem A.B.M. Method of detecting anomalies in IoT device traffic based on statistical analysis using the modified Z score // CEUR Workshop Proceedings. 2025. V. 3963. P. 284–298.Stetsiuk M., Anikin V., Pyrch O., Kozelskiy O., Salem A.B.M. Method of detecting anomalies in IoT device traffic based on statistical analysis using the modified Z score // CEUR Workshop Proceedings. 2025. V. 3963. P. 284–298.Wang J., Yu L., Lui J.C.S., Luo X. Modern DDoS threats and countermeasures: insights into emerging attacks and detection strategies // arXiv. 2025. arXiv:2502.19996. https://doi.org/10.48550/arXiv.2502.19996Wang J., Yu L., Lui J.C.S., Luo X. Modern DDoS threats and countermeasures: insights into emerging attacks and detection strategies // arXiv. 2025. arXiv:2502.19996. https://doi.org/10.48550/arXiv.2502.19996Alam M.N., Laxmi V., Sharma A., Dangi S. Machine learning: key algorithms, practical applications, and current research directions // International Journal of Electrical and Electronics Engineering. 2025. V. 12. N 4. P. 12–46. https://doi.org/10.14445/23488379/ijeeev12i4p102Alam M.N., Laxmi V., Sharma A., Dangi S. Machine learning: key algorithms, practical applications, and current research directions // International Journal of Electrical and Electronics Engineering. 2025. V. 12. N 4. P. 12–46. https://doi.org/10.14445/23488379/ijeeev12i4p102Chen Y., Peng Y., Tang J., Camilleri T., Camilleri K., Kong W., et al. EEG-based affective brain-computer interfaces: recent advancements and future challenges // Journal of Neural Engineering. 2025. V. 22. N 3. P. 031004. https://doi.org/10.1088/1741-2552/ade290Chen Y., Peng Y., Tang J., Camilleri T., Camilleri K., Kong W., et al. EEG-based affective brain-computer interfaces: recent advancements and future challenges // Journal of Neural Engineering. 2025. V. 22. N 3. P. 031004. https://doi.org/10.1088/1741-2552/ade290Thakur P., Kaur N., Aggarwal N., Singh S. A comprehensive review of unimodal and multimodal emotion detection: datasets, approaches, and limitations // Expert Systems. 2025. V. 42. N 9. P. e70103. https://doi.org/10.1111/exsy.70103Thakur P., Kaur N., Aggarwal N., Singh S. A comprehensive review of unimodal and multimodal emotion detection: datasets, approaches, and limitations // Expert Systems. 2025. V. 42. N 9. P. e70103. https://doi.org/10.1111/exsy.70103Rai N., Grover J. Analysis of crypto module in RIOT OS using Frama-C // The Journal of Supercomputing. 2024. V. 80. N 13. P. 18521–18543. https://doi.org/10.1007/s11227-024-06171-0Rai N., Grover J. Analysis of crypto module in RIOT OS using Frama-C // The Journal of Supercomputing. 2024. V. 80. N 13. P. 18521–18543. https://doi.org/10.1007/s11227-024-06171-0Dymova H. Study of cryptographic security of computer networks // Computer-Integrated Technologies: Education, Science, Production. 2025. N 57. P. 15–19. https://doi.org/10.36910/6775-2524-0560-2024-57-02Dymova H. Study of cryptographic security of computer networks // Computer-Integrated Technologies: Education, Science, Production. 2025. N 57. P. 15–19. https://doi.org/10.36910/6775-2524-0560-2024-57-02Alaba F.A., Othman M., Hashem I.A.T., Alotaibi F. Internet of Things security: a survey // Journal of Network and Computer Applications. 2017. V. 88. P. 10–28. https://doi.org/10.1016/j.jnca.2017.04.002Alaba F.A., Othman M., Hashem I.A.T., Alotaibi F. Internet of Things security: a survey // Journal of Network and Computer Applications. 2017. V. 88. P. 10–28. https://doi.org/10.1016/j.jnca.2017.04.002Sicari S., Rizzardi A., Grieco L.A., Coen-Porisini A. Security, privacy and trust in Internet of Things: the road ahead // Computer Networks. 2015. V. 76. P. 146–164. https://doi.org/10.1016/j.comnet.2014.11.008Sicari S., Rizzardi A., Grieco L.A., Coen-Porisini A. Security, privacy and trust in Internet of Things: the road ahead // Computer Networks. 2015. V. 76. P. 146–164. https://doi.org/10.1016/j.comnet.2014.11.008Roman R., Najera P., Lopez J. Securing the Internet of Things // Computer. 2011. V. 44. N 9. P. 51–58. https://doi.org/10.1109/mc.2011.291Roman R., Najera P., Lopez J. Securing the Internet of Things // Computer. 2011. V. 44. N 9. P. 51–58. https://doi.org/10.1109/mc.2011.291Jing Q., Vasilakos A.V., Wan J., Lu J., Qiu D. Security of the Internet of Things: perspectives and challenges // Wireless Networks. 2014. V. 20. N 8. P. 2481–2501. https://doi.org/10.1007/s11276-014-0761-7Jing Q., Vasilakos A.V., Wan J., Lu J., Qiu D. Security of the Internet of Things: perspectives and challenges // Wireless Networks. 2014. V. 20. N 8. P. 2481–2501. https://doi.org/10.1007/s11276-014-0761-7Yang Y., Wu L., Yin G., Li L., Zhao H. A survey on security and privacy issues in Internet-of-Things // IEEE Internet of Things Journal. 2017. V. 4. N 5. P. 1250–1258. https://doi.org/10.1109/JIOT.2017.2694844Yang Y., Wu L., Yin G., Li L., Zhao H. A survey on security and privacy issues in Internet-of-Things // IEEE Internet of Things Journal. 2017. V. 4. N 5. P. 1250–1258. https://doi.org/10.1109/JIOT.2017.2694844Granjal J., Monteiro E., Silva J.S. Security for the Internet of Things: a survey of existing protocols and open research issues // IEEE Communications Surveys & Tutorials. 2015. V. 17. N 3. P. 1294– 1312. https://doi.org/10.1109/COMST.2015.2388550Granjal J., Monteiro E., Silva J.S. Security for the Internet of Things: a survey of existing protocols and open research issues // IEEE Communications Surveys & Tutorials. 2015. V. 17. N 3. P. 1294– 1312. https://doi.org/10.1109/COMST.2015.2388550Weber R.H. Internet of Things – New security and privacy challenges // Computer Law & Security Review. 2010. V. 26. N 1. P. 23–30. https://doi.org/10.1016/j.clsr.2009.11.008Weber R.H. Internet of Things – New security and privacy challenges // Computer Law & Security Review. 2010. V. 26. N 1. P. 23–30. https://doi.org/10.1016/j.clsr.2009.11.008Mosenia A., Jha N.K. A comprehensive study of security of Internetof- Things // IEEE Transactions on Emerging Topics in Computing. 2017. V. 5. N 4. P. 586–602. https://doi.org/10.1109/TETC.2016.2606384Mosenia A., Jha N.K. A comprehensive study of security of Internetof- Things // IEEE Transactions on Emerging Topics in Computing. 2017. V. 5. N 4. P. 586–602. https://doi.org/10.1109/TETC.2016.2606384Khan M.A., Salah K. IoT security: review, blockchain solutions, and open challenges // Future Generation Computer Systems. 2018. V. 82. P. 395–411. https://doi.org/10.1016/j.future.2017.11.022Khan M.A., Salah K. IoT security: review, blockchain solutions, and open challenges // Future Generation Computer Systems. 2018. V. 82. P. 395–411. https://doi.org/10.1016/j.future.2017.11.022Savenko O., Lysenko S., Kryschuk A. Multi-agent based approach of botnet detection in computer systems // Communications in Computer and Information Science. 2012. V. 291. P. 171–180. https://doi.org/10.1007/978-3-642-31217-5_19Savenko O., Lysenko S., Kryschuk A. Multi-agent based approach of botnet detection in computer systems // Communications in Computer and Information Science. 2012. V. 291. P. 171–180. https://doi.org/10.1007/978-3-642-31217-5_19Dong Z. Artificial Intelligence for Multimodal Data Analysis and Applications: Ph.D. Dissertation. State University of New York at Stony Brook. 2025.Dong Z. Artificial Intelligence for Multimodal Data Analysis and Applications: Ph.D. Dissertation. State University of New York at Stony Brook. 2025.Ahmed M., Mahmood A.N., Hu J. A survey of network anomaly detection techniques // Journal of Network and Computer Applications. 2016. V. 60. P. 19–31. https://doi.org/10.1016/j.jnca.2015.11.016Ahmed M., Mahmood A.N., Hu J. A survey of network anomaly detection techniques // Journal of Network and Computer Applications. 2016. V. 60. P. 19–31. https://doi.org/10.1016/j.jnca.2015.11.016

The authors declare that there are no conflicts of interest present.