ESTIMATION OF SELF-SIMILAR TRAFFIC CHARACTERISTICS OF INFORMATION AND COMMUNICATION NETWORKS FOR ATTACK DETECTION SYSTEMS

Abstract

The urgency of development and improvement of intrusion detection systems, the main task of which is to recognize network attacks, attempts of unauthorized access and use of network resources, is determined in the work. This problem is solved by using monitoring tools that can analyze network traffic in real time. For this purpose, a method of estimating and determining the characteristics of self-similar traffic of modern information and communication networks has been developed, which allows to form a vector of informative features for determining anomalies for the attack detection system. On the example of the experimental signal of Ethernet traffic in accordance with the proposed method, the characteristics of network traffic are analyzed and determined. The aim there is a substantiation of a technique of complex estimation of characteristics of self-similar traffic of information and communication systems and networks concerning definition of anomalies for systems of detection of attacks. The methodology the solution of this problem is the integrated use of methods of time-frequency, statistical, fractal and multifractal analysis, adequate to the laws of modern traffic of information and communication networks, which has a self-similar (fractal or multifractal) nature. Scientific novelty. The method of complex estimation of selfsimilar traffic characteristics of information and communication networks, including time-frequency, statistical, fractal and multifractal analyzes, which allows to increase the probability of intrusion detection for attack detection systems by increasing the reliability of informative features of self-similar traffic. Conclusions. The offered technique of complex use of the methods of the analysis adequate to laws of modern traffic of information and communication networks, increases efficiency of definition of anomalies at the expense of increase of informativeness of the estimated characteristics of traffic.