О ЗАКОНОМЕРНОСТЯХ ПРИ ОБНАРУЖЕНИИ АТАК "ОТКАЗ В ОБСЛУЖИВАНИИ" В КОМПЬЮТЕРНЫХ СЕТЯХ

Abstract

The issues of detecting types of DDOS attacks in computer networks are considered. The methodology is proposed for analyzing the properties of the boundary objects between types of DDOS attacks and normal traffic according to a given metric. A methodology is focused on searching for patterns associated with the selection of sets of informative features and the calculation of local distribution density values for boundary objects of classes. To select informative features, it is proposed to use the stability property for each feature. The stability indicator does not depend on the scales and magnitudes of measurement, and is also distinguished by the constancy of values in selection from the general assembly. Local areas in the form of hyperspheres for calculating the distribution density are represented by objects of one of the classes. Such representation is associated with the choice of the radius of the hypershare as the distance from the boundary object to the first closest object from the complement to its class. The density values in the hypershare are used in the analysis of the relations of objects of the class to the boundary one. Linguistic variables and visual representation are used to interpret relationships. In the form of a computational experiment, the connection between the selection of informative features and the values of the local distribution density is demonstrated. The use of the methodology minimizes the cost of computing resources. The “curse of dimensionality” issue is solved as well as the reducing the probability of overfitting in machine learning is.