Comparative Analysis and Development of Recommendations for the Use of Machine Learning Methods to Identify Network Traffic Anomalies in the Development of a Subsystem for User Behavioral Analysis

Abstract

This article discusses various machine learning methods in order to conduct a more effective analysis of user network traffic using a subsystem for analyzing user behavior and detecting network anomalies, since there is a need to evaluate big data. The methods and techniques used to detect network anomalies are analyzed. In analyzing the methods and technologies used to detect network anomalies, a classification of anomaly detection methods is proposed. To solve these problems, different algorithms can be used, differing in specificity and, as a result, efficiency. The classification of machine learning methods for detecting network anomalies is considered separately, since machine learning algorithms will be the most effective for the task. Various criteria for evaluating the effectiveness of machine learning models in solving the problem of network traffic profiling are considered. In accordance with the specifics of the tasks of user recognition and network anomaly detection, the most appropriate criteria for evaluating the effectiveness of machine learning models have been selected: AUC ROC – the area under the error curve. Four stages of the subsystem for analyzing user behavior and detecting network anomalies are highlighted.