bsuirДоклады БГУИРDoklady BGUIR1729-76482708-0382БГУИР10.35596/1729-7648-2025-23-4-77-84bsuir-4185Research ArticleСтатьиАрхитектура прототипа системы обнаружения аномалий сетевого трафика на основе машинного обучения и визуальной аналитикиArchitecture of a Prototype System for Network Traffic Anomaly Detection Based on Machine Learning and Visual AnalyticsВанС.WangX.

магистрант каф. защиты информации и эргономики 

Минск 

Master’s Student at the Information Security Department 

СаймановИ. М.SaymanovI. M.

канд. техн. наук, доц., доц. каф. информационной безопасности 

Ташкент 

Cand. Sci. (Tech.), Associate Professor, Associate Professor at the Information Security Department 

Tashkent 

КабуловА. В.KabulovA. V.

д-р техн. наук, проф., проф. каф. информационной безопасности 

Ташкент 

Dr. Sci. (Tech.), Professor, Professor at the Information Security Department

Tashkent 

ПрудникА. М.PrudnikA. M.

Прудник Александр Михайлович, канд. техн. наук, доц., доц. каф. инженерной психологии и эргономики 

220013, Минск, ул. П. Бровки, 6 

Тел.: +375 17 293-85-24 

Prudnik Aleksander Mikhailovich, Cand. Sci. (Tech.), Associate Professor, Associate Professor at the Engineering Psychology and Ergonomics Department 

220013, Minsk, P. Brovki St., 6 

Tel.: +375 17 293-85-24 

aleksander.prudnik@bsuir.byБелорусский государственный университет информатики и радиоэлектроники (БГУИР)Belarusian State University of Informatics and Radioelectronics (BSUIR)Национальный университет Узбекистана имени Мирзо Улугбека (НУУ)National University of Uzbekistan named after Mirzo Ulugbek (NUU)Белорусский государственный университет информатики и радиоэлектроникиBelarusian State University of Informatics and Radioelectronics (BSUIR)2025030920252347784Copyright © Ван С., Сайманов И.М., Кабулов А.В., Прудник А.М., 20252025Ван С., Сайманов И.М., Кабулов А.В., Прудник А.М.Wang X., Saymanov I.M., Kabulov A.V., Prudnik A.M.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://doklady.bsuir.by/jour/article/view/4185

Представлена архитектура прототипа системы для обнаружения аномалий сетевого трафика. Система основана на трехуровневой архитектуре с использованием веб-фреймворка Flask для создания RESTful API. Для обнаружения аномалий применяется алгоритм машинного обучения без учителя Isolation Forest (100 эстиматоров, фактор контаминации 0,05) из библиотеки scikit-learn, осуществляющий обработку данных, предварительно нормализованных с помощью StandardScaler, в одночасовых окнах. Результаты анализа, включающие многоуровневую классификацию серьезности аномалий (с нормализованными оценками в диапазоне 0–1, где значения более 0,8 соответствуют критическому уровню) и обеспечиваю­щие совместимость с SIEM-системами, интерактивно визуализируются посредством Chart.js. Рассмот­рены ключевые теоретические и практические вызовы, такие как качество данных, выбор признаков, масштабируемость (алгоритмическая сложность O(n log n)), оптимизация параметров и интерпрети­руемость результатов.

The paper presents the architecture of a prototype system for detecting network traffic anomalies. The system is based on a three-tier architecture using the Flask web framework to create a RESTful API. Anomaly detection is implemented using the Isolation Forest unsupervised machine learning algorithm (100 estimators, contamination factor 0.05) from the scikit-learn library, which processes data pre-normalized using StandardScaler in one-hour windows. The analysis results, including a multi-level classification of anomaly severity (with norma­ lized scores in the range of 0–1, where values greater than 0.8 correspond to the critical level) and ensuring compatibility with SIEM systems, are interactively visualized using Chart.js. Key theoretical and practical challenges, such as data quality, feature selection, scalability (algorithmic complexity O(n log n)), parameter optimization, and interpretability of results, are discussed.

обработка сетевого трафикаобнаружение аномалиймашинное обучениеалгоритм Isolation Forestвизуальная аналитикаархитектура системымасштабируемостьинтерпретируемостькачество данныхnetwork traffic processinganomaly detectionmachine learningIsolation Forest algorithmvisual analyticssystem architecturescalabilityinterpretabilitydata qualityReferencesSommer R., Paxson V. (2010) Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. IEEE Symposium on Security and Privacy. 305–316.Sommer R., Paxson V. (2010) Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. IEEE Symposium on Security and Privacy. 305–316.GarcΊa-Teodoro P., DΊaz-Verdejo J., Maciá-Fernández G., Vázquez E. (2009) Anomaly-Based Network Intrusion Detection: Techniques, Systems and Challenges. Computers & Security. 28 (1–2), 18–28.GarcΊa-Teodoro P., DΊaz-Verdejo J., Maciá-Fernández G., Vázquez E. (2009) Anomaly-Based Network Intrusion Detection: Techniques, Systems and Challenges. Computers & Security. 28 (1–2), 18–28.Buczak A. L., Guven E. (2016) A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection. IEEE Communications Surveys & Tutorials. 18 (2), 1153–1176.Buczak A. L., Guven E. (2016) A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection. IEEE Communications Surveys & Tutorials. 18 (2), 1153–1176.Bhuyan M. H., Bhattacharyya D. K., Kalita J. K. (2014) Network Anomaly Detection: Methods, Systems and Tools. IEEE Communications Surveys & Tutorials. 16 (1), 303–336.Bhuyan M. H., Bhattacharyya D. K., Kalita J. K. (2014) Network Anomaly Detection: Methods, Systems and Tools. IEEE Communications Surveys & Tutorials. 16 (1), 303–336.D’Amico A., Whitley K. (2008) The Real Work of Computer Network Defense Analysts. VizSEC 2007 (Mathe­ matics and Visualization). 19–37.D’Amico A., Whitley K. (2008) The Real Work of Computer Network Defense Analysts. VizSEC 2007 (Mathe­ matics and Visualization). 19–37.Ring M., Wunderlich S., Grüdl D., Landes D., Hotho A. (2017) Flow-Based Benchmark Data Sets for Intrusion Detection. Proc. of the 16th European Conf. on Cyber Warfare and Security. 361–369.Ring M., Wunderlich S., Grüdl D., Landes D., Hotho A. (2017) Flow-Based Benchmark Data Sets for Intrusion Detection. Proc. of the 16th European Conf. on Cyber Warfare and Security. 361–369.Sharafaldin I., Lashkari A. H., Ghorbani A. A. (2018) Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proc. of the 4th International Conf. on Information Systems Security and Privacy. 108–116.Sharafaldin I., Lashkari A. H., Ghorbani A. A. (2018) Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. Proc. of the 4th International Conf. on Information Systems Security and Privacy. 108–116.Cordero C. G., Vasilomanolakis E., Milanov N., Koch C., Hausheer D., Mühlhäuser M. (2015) An Overview of the Botnet Simulation Framework. IEEE Conf. on Communications and Network Security (CNS). 739–740.Cordero C. G., Vasilomanolakis E., Milanov N., Koch C., Hausheer D., Mühlhäuser M. (2015) An Overview of the Botnet Simulation Framework. IEEE Conf. on Communications and Network Security (CNS). 739–740.Liu F. T., Ting K. M., Zhou Z. H. (2012) Isolation-Based Anomaly Detection. ACM Transactions on Know­ ledge Discovery from Data. 6 (1), 1–39.Liu F. T., Ting K. M., Zhou Z. H. (2012) Isolation-Based Anomaly Detection. ACM Transactions on Know­ ledge Discovery from Data. 6 (1), 1–39.Ding Z., Fei M. (2013) An Anomaly Detection Approach Based on Isolation Forest Algorithm for Streaming Data Using Sliding Window. IFAC Proceedings Volumes. 46 (20), 12–17.Ding Z., Fei M. (2013) An Anomaly Detection Approach Based on Isolation Forest Algorithm for Streaming Data Using Sliding Window. IFAC Proceedings Volumes. 46 (20), 12–17.Apruzzese G., Colajanni M., Ferretti L., Guido A., Marchetti M. (2018) On the Effectiveness of Machine and Deep Learning for Cyber Security. 2018 10th International Conference on Cyber Conflict (CyCon). 371–390. IEEE.Apruzzese G., Colajanni M., Ferretti L., Guido A., Marchetti M. (2018) On the Effectiveness of Machine and Deep Learning for Cyber Security. 2018 10th International Conference on Cyber Conflict (CyCon). 371–390. IEEE.Wang H., Bah M. J., Hammad M. (2019) Progress in Outlier Detection Techniques: A Survey. IEEE Access. 7, 107964–108000.Wang H., Bah M. J., Hammad M. (2019) Progress in Outlier Detection Techniques: A Survey. IEEE Access. 7, 107964–108000.Ribeiro M. T., Singh S., Guestrin C. (2016) “Why Should I Trust You?”: Explaining the Predictions of Any Classifier. Proc. of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mi­ ning. 1135–1144.Ribeiro M. T., Singh S., Guestrin C. (2016) “Why Should I Trust You?”: Explaining the Predictions of Any Classifier. Proc. of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mi­ ning. 1135–1144.Perdisci R., Ariu D., Fogla P., Giacinto G., Lee W. (2009) McPAD: A Multiple Classifier System for Accurate Payload-Based Anomaly Detection. Computer Networks. 53 (6), 864–881.Perdisci R., Ariu D., Fogla P., Giacinto G., Lee W. (2009) McPAD: A Multiple Classifier System for Accurate Payload-Based Anomaly Detection. Computer Networks. 53 (6), 864–881.Staheli D., Yu T., Crouser R. J., Damodaran S., Nam K., O’Gwynn D., et al. (2014) Visualization Evaluation for Cyber Security: Trends and Future Directions. VizSec ‘14: Proceedings of the Eleventh Workshop on Visua­ lization for Cyber Security. 49–56.Staheli D., Yu T., Crouser R. J., Damodaran S., Nam K., O’Gwynn D., et al. (2014) Visualization Evaluation for Cyber Security: Trends and Future Directions. VizSec ‘14: Proceedings of the Eleventh Workshop on Visua­ lization for Cyber Security. 49–56.Perdisci R., Lee W., Feamster N. (2010) Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces. NSDI’10: Proceedings of the 7th USENIX Conference on Networked Systems Design and Implementation. 12.Perdisci R., Lee W., Feamster N. (2010) Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces. NSDI’10: Proceedings of the 7th USENIX Conference on Networked Systems Design and Implementation. 12.

The authors declare that there are no conflicts of interest present.