NETWORK ACTIVITY MONITORING SYSTEM USING ELEMENTS OF ARTIFICIAL INTELLIGENCE

Abstract

The paper considers issues related to solving the complex scientific and practical problem of
developing an intelligent network traffic monitoring system to detect intrusions using machine learning methods.
The paper covers the analysis of modern approaches to network security, design and software implementation of
key system modules, as well as experimental research into the effectiveness of the proposed solution. Analysis of
the state of network monitoring and intrusion detection systems, in particular signature systems (Snort, Suricata)
and flow analysis systems (NetFlow, sFlow) showed that classical approaches are characterized by limited ability
to detect new and modified attacks, while intelligent methods provide higher adaptability, but require the correct
selection of data and models. In this regard, a system was proposed that uses modern datasets with realistic attack
scenarios. The system is created on the basis of a technological stack implemented in Python using the Scapy,
Pandas, NumPy and Scikit-learn libraries. A traffic interception mechanism, feature engineering, data
normalization, and flow classification using the Random Forest algorithm are implemented. Unlike signature
systems, the proposed solution does not require constant manual updating of rules and is able to generalize
behavioral signs of attacks.