Using anomaly detection method to detect network attacks

Abstract

The article is focused on the description of a model for detecting network intrusions in the network traffic based on the TCP/IP protocol stack. The main objects of a local area network have been analyzed. The main controlled parameters of each type of object have been described. The methods of anomaly detection based on both rule-based and probabilistic model analysis have been developed.

Relevance. Due to the intensive growth of information technologies and their implementation in various sectors of the municipal economy, the issue of information security becomes very relevant.

Research methods. In solving the tasks, the methods of control theory; methods of building security systems; graph theory; probability theory and mathematical statistics; methods of time series analysis; methods of predictive analytics and big data processing; methods of building high-load secure programs have been used. The main research methods used are probabilistic and verification modeling.

The results. Probabilistic and verification modeling of network attacks has confirmed the effectiveness of the proposed approach. The results of synthesis using CAD showed that the additional hardware costs do not exceed 20% compared to the standard description model.

Conclusions. The developed system model allows detection of attacks on key simulated objects. The results obtained during the tests showed a high efficiency of detecting anomalies in the numerical parameters of the model. In order to increase accuracy, it is planned to move on to the modeling of the concept of "service" and the modeling of HTTP, SMTP, and POP3 protocols. The session model also allows detecting existing and new TCP session-level attacks, as well as some types of denial-of-service attacks. The model of network traffic flows allows us to detect such types of attacks as: various types of system scanning, installation of Trojan programs (because the number of bytes in the output stream will increase), installation of ICMP shell (because the number of ICMP packets will increase). The time interval model allows detecting some types of system scanning, denial-of-service attacks, and web shell installation.