MATHEMATICAL MODEL OF SEMANTIC ATTRIBUTION OF CYBER INCIDENTS IN ANOMALY DETECTION SYSTEMS BASED ON DEEP LEARNING

DOI: 10.31673/2409-7292.2025.032076

Abstract

For the first time, an automated mathematical model of semantic attribution of cyber incidents is proposed, integrated
into a deep anomaly system to transition from expert signaling to automatic contextual threat identification. The proposed
approach is based on traffic analysis (autoencoder reconstruction of normal behavior and short-term MLP prediction with
adaptive anomaly boundary formation) with a content-semantic layer, which performs deep parsing of payload and header fields,
construction of vector data and search precedents in the database of historical incidents (SQLi classes/families, XSS,
XXE/XSLT, brute force, etc.). Aggregated risk scoring is introduced before the criticality assessment module, combining
anomaly strength, attribution and contextual asset reliability, and XAI explainability mechanisms (important tokens/fields,
closest keys) to improve decision interpretability and human-on-the-loop mode. The implementation is focused on streaming
scenarios and compatible with SIEM/SOAR, which simplifies implementation in critical infrastructure, telecommerce networks,
financial sector, and cloud environments. Experimental studies on proprietary network datasets demonstrate the statistical
significance of reducing false positives and increasing integral metrics (Precision/Recall/F1) according to rules and purely
behavioral approaches, as well as reducing SOC response time. The results obtained confirm that the integration of semantic
attribution with behavioral detection formalizes the mapping "anomaly → cyber incident", performs the reproducibility and
controllability of the process and creates the basis for a scalable next-generation cyber defense system.
Keywords: cyber incidents, anomaly detection, semantic attribution, machine learning, autoencoder, criticality module,
cyber-attack precedents, cybersecurity, cyber-attack, cyber defense, critical infrastructure, cyber threat.

References
1. Chandola V., Banerjee A., Kumar V. Anomaly detection: A survey. ACM Computing Surveys, 2009.
2. Kim H., Park H., Lee H. Network anomaly detection using statistical models. Computer Communications,
2014.
3. Ahmed M., Mahmood A., Hu J. A survey of network anomaly detection techniques. Journal of Network and
Computer Applications, 2016.
4. Vincent P. et al. Extracting and composing robust features with denoising autoencoders. ICML, 2008.
5. Zhang Y. et al. Traffic prediction in SDN using deep learning. IEEE Access, 2020.
6. Wang W. et al. HAST-IDS: Learning hierarchical spatial-temporal features using deep neural networks to
improve intrusion detection. IEEE Access, 2017.
7. Kitsune: An ensemble of autoencoders for online network intrusion detection. NDSS, 2018.
8. Sommer R., Paxson V. Outside the closed world: On using machine learning for network intrusion detection.
IEEE Symposium on Security and Privacy, 2010.
9. Li Y. et al. Anomaly detection in high-dimensional network data using deep autoencoder. Future Generation
Computer Systems, 2019.
10. Huang C. et al. Deep autoencoder-based anomaly detection in SDN. IEEE Transactions on Network and
Service Management, 2020.
11. ISO/IEC 27001:2022. Information security management systems.
12. NIST SP 800-94. Guide to Intrusion Detection and Prevention Systems (IDPS), 2021.
13. Шульга В., Іванченко Є., Аверічев І., Рижаков М. Методи інтелектуального виявлення аномалій і
критичних ситуацій у кіберсистемах на основі глибокого навчання. Information Technology: Computer Science,
Software Engineering and Cyber Security, 2025.
14. Іванченко Є.В., Рижаков М.М. Узагальнена модель прогнозування та виявлення кібербезпекових
аномалій на основі штучного інтелекту. Збірник наукових праць, 2025.