Detection of Network Anomalies by Machine Learning Methods

Currently, the main way to protect against network attacks, not taking into account the software elimination of vulnerabilities, is the signature method. This approach makes it possible to detect attacks based on the previously identified pattern. For protection, a set of measures is used to prevent the attack itself and distribute the load, in the case of a dos (denial of service) attack. This paper discusses and demonstrates a new approach to detecting anomalous activity in traffic: based on a deep analysis of traffic packets to determine flood attacks and payloads for NGFW systems, using classical machine learning algorithms and neural networks. It is assumed that in the future such solutions will significantly expand the ability to analyze cybersecurity events, correlating anomalies detected by the signature method and the method based on machine learning.