Open AccessDetection of network intelligence features with the decision tree model
Author(s) -
N. P. Sharaev,
Svetoslav Petrov
Publication year - 2022
Publication title -
informatika
Language(s) - English
Resource type - Journals
eISSN - 2617-6963
pISSN - 1816-0301
DOI - 10.37661/1816-0301-2022-19-1-19-31
Subject(s) - decision tree , computer science , artificial intelligence , machine learning , data mining , principal component analysis , tree (set theory) , task (project management) , software , mathematics , engineering , systems engineering , programming language , mathematical analysis
O b j e c t i v e s . Early detection of network intelligence allows to reduce the risks of information security of organizations. The study was carried out to develop software module for detecting the features of network intelligence by machine learning methods. M e t h o d s . Analysis of open datasets of appropriate destination; formation of metrics characteristic of network intelligence; development of a dataset based on certain metrics; study of the effectiveness of machine learning methods for classification task. R e s u l t s . The topology was designed and a test segment was created in the corporate network of RUE "Beltelecom" to create a dataset. A monitoring tool has been developed for detecting and analyzing the events, the results of which were used as the basis for a new dataset. The implementation of the decision tree method in the form of program code allowed to increase the speed of the module by about 2 times (0,147 ms). Practical tests of the developed module have shown the alarm on all types of network scanning using Nmap and Masscan utilities. Co n c l u s i o n. The analysis of the dataset by principal component method showed the presence of a border area between the events of legal traffic and network intelligence traffic, which had a positive effect on the training of the model. The most promising machine learning methods have been studied and tested using various hyperparameters. The best results were shown by the decision tree method with the parameters criterion = gini and splitter = random and speed as 0,333 ms.