МЕТОД И АЛГОРИТМЫ ОБНАРУЖЕНИЯ АНОМАЛИИ В ТРАФИКЕ МУЛЬТИСЕРВИСНЫХ СЕТЕЙ СВЯЗИ, ОСНОВАННЫЕ НА НЕЧЕТКОМ ЛОГИЧЕСКОМ ВЫВОДЕ

Abstract

Introduction: The major requirement imposed to the systems of detection and prevention of malicious invasions into modern telecommunication infrastructures is the ability to find anomalies and invasion threats in real time. The complexity of this problem is in many respects caused by the incompleteness, discrepancy and diversity of the a priori knowledge about the distribution laws peculiar to the traffic of multiservice communication networks, as well as by the changing nature of malicious actions which make computer systems unsafe. Purpose: Increasing the speed and reliability of network traffic anomaly detection when the analyzed information is incomplete and highly heterogeneous. Results: A hybrid method and adaptive algorithms have been proposed for real-time anomaly detection in multiservice communication network traffic. The hybrid method unites the mechanism of non-identificational adaptation to the changing traffic parameters with the fuzzy logical inference used for regulating the algorithm parameters and for analyzing the output data. The adaptive algorithms are focused on combined implementation of modified stochastic approximation and pseudogradient search procedures. An experimental assessment has shown that the functional characteristics of the algorithms are close to the potentially achievable ones. Practical relevance: The developed method and algorithms can be implemented on available hardwaresoftware platforms on the basis of intellectual agent technology. Sharing them with already existing methods and algorithms of invasion detection can considerably increase the efficiency of information security systems in multiservice communication networks.