Anomaly-based detection system in computer networks

Abstract

Effective detection of new types of cyber-attacks, such as 'zero-day', as well as attacks which have no signatures associated with the widespread use of appropriate means of protection. The existing intrusion detection systems use the mathematical models for security solution, which require a lot of resources and expenses of different nature, for example, connected with sample of statistical data, training systems, its adaptation, etc. More effective in this regard are peer-based approaches and knowledge of the subject area specialists. To meet this challenge, based on the anomaly detection technique based on fuzzy logic it was suggested the structural solution of anomaly-based detection system in computer networks, created by the unsignature attacks. The system is composed of primary processing subsystems, generation of fuzzy standards and heuristic rules, as well as Fuzzy Modular Arithmetic, linguistic corollary and visualization, that make possible to identify the abnormal condition in the network traffic, generated by a specific type of cyber-attacks. The result of the system is represented in linguistic and graphic forms.