A model for detecting malicious activity in an organization’s information system based on hybrid classification

DOI: 10.31673/2409-7292.2024.040003

Abstract

The article is devoted to the study of methods for detecting malicious processes in an organization’s information system using machine learning methods. The number of attacks, which according to statistics, increases every year, indicates that intrusion detection methods require further development. The use of machine learning can increase the ability of protection systems to detect malicious processes. To solve the problem of detecting malicious processes in work, a hybrid classification model for detecting intrusions in an organization’s information system is proposed. The proposed model is built on the use of several machine learning methods. These methods include the support vector method, decision trees, and k-nearest neighbors. The description of the main stages of applying the specified methods of the proposed model provides a generalized understanding of the features of the work. The CSE-CIC-IDS2018 datasets of the Canadian Institute of Cybersecurity were used. The main stages necessary for the correct operation of the proposed model are proposed for processing the data set. It is expected that this approach will reduce the model’s runtime and improve the quality and accuracy of detecting malicious activity in the organization’s information system. The hybrid classification is based on the assembly learning method - stacking, which involves training several models on the same data set, and then using another classifier, which is trained on the output data of these models and determines how to combine them to obtain the final forecast. Therefore, the proposed malicious activity detection model will allow obtaining forecast results that will be compared with the results of the model based on each selected machine learning algorithm.

Keywords: cybersecurity, cyberattack, malicious activity, botnet, machine learning, classification.