Using a neural network instead of the knowledge base in the expert system of web resources malicious traffic detector.

Abstract

The modern world of information technology provides us with a wide range of web applications. Indeed, there is a constant need for solid protection of web resources and their confidential information. As the number of cyber-attacks increases, so do their critical consequences for organizations and individuals. This work developed the elements of the expert system and evaluated their effectiveness. The main purpose of using an expert system is to increase the protection of web resources against cyberattacks (such as SQLi, XSS, SSI, BufferOverflow, etc.) by ensuring that information security specialists are quickly aware of the attack presence. The neural network is capable of detecting and classifying malicious web server traffic. The advantages of using a neural network include: effective construction of non-linear dependencies, adaptation to changes and evaluation of “zero-day" attacks, fault tolerance, relative simplicity of implementation, calculation speed after training. The result of the work is a developed element of the expert system – a trained and verified neural network model that guarantees 98% success in detecting cyberattacks on web resources, as well as errors types I and II in the neural model do not exceed 5%.