Anomaly and Cyber Attack Detection Technique Based on the Integration of Fractal Analysis and Machine Learning Methods

Abstract

In modern data transmission networks, in order to constantly monitor network traffic and detect abnormal activity in it, as well as identify and classify cyber attacks, it is necessary to take into account a large number of factors and parameters, including possible network routes, data delay times, packet losses and new traffic properties that differ from normal. All this is an incentive to search for new methods and techniques for detecting cyber attacks and protecting data networks from them. The article discusses a technique for detecting anomalies and cyberattacks, designed for use in modern data networks, which is based on the integration of fractal analysis and machine learning methods. The technique is focused on real-time or near-real-time execution and includes several steps: (1) detecting anomalies in network traffic, (2) identifying cyber attacks in anomalies, and (3) classifying cyber attacks. The first stage is implemented using fractal analysis methods (evaluating the self-similarity of network traffic), the second and third stages are implemented using machine learning methods that use cells of recurrent neural networks with a long short-term memory. The issues of software implementation of the proposed technique are considered, including the formation of a data set containing network packets circulating in the data transmission network. The results of an experimental evaluation of the proposed technique, obtained using the generated data set, are presented. The results of the experiments showed a rather high efficiency of the proposed technique and the solutions developed for it, which allow early detection of both known and unknown cyber attacks.