Neural-fuzzy prediction of self-similar traffic of information and communication networks for attack detection systems

Abstract

It was established that the current task is to build adequate predictive models of network self-similar traffic, which would allow their use in IDS for detecting network anomalies in real time with sufficient efficiency in terms of errors and reliability and increased efficiency. It is proposed to use adaptive filter-approximators in the form of adaptive fuzzy inference systems based on the Sugeno-Takagi, Takagi-Sugeno-Kang and Wang-Mendel algorithms for predicting self-similar traffic of information and communication networks. Since the problem of substantiating the type of neuro-fuzzy AFA with setting its parameters is polymodal, this requires the use of global optimization methods. The modeling of the network traffic forecasting process was carried out in the Matlab environment based on experimental data - traffic transmitted over the Internet. Multi-criteria optimization, direct random search and simulated annealing method were used as global optimization methods. The criterion of non-displacement (minimum shift) was used as the criterion of global optimization, and the criterion of parametric optimization was the regularity criterion, which was calculated on the test sample. As a result of the modeling, it was found that direct random search and multi-criteria optimization have the best convergence speed, the simulated annealing method showed the best performance, and the multi-criteria optimization algorithm showed the best convergence. It was also established that the minimum regularity criterion is met by the Anfis AFA based on the Takagi-Sugeno-Kanga algorithm, which is trained by a hybrid algorithm. Adequacy of the received traffic models of information and communication networks with experimental data was checked and confirmed by the non-parametric criterion of signs. Further research should be aimed at substantiating and investigating the informativeness of the characteristics and models of self-similar network traffic and the effectiveness of the criteria and methods for recognizing attacks.