Development of a Model of Cyberattacks Identification Based on the Analysis of Device States in the Network of a Telecommunications Service Provider
L.S. Zabrodina, Denis Parfenov, Irina Pavlovna Bolodurina, Vadim A. Torchin, Arthur Zhigalov · 2019 International Multi-Conference on Engineering, Computer and Information Sciences (SIBIRCON) · 2019
This paper is aimed in development of an attack detection model based on an analysis of the state chains of network nodes. In our research, we solve the problem of a typical attack profile in a network of telecommunication service providers formalization while constructing a sequence of network nodes state shiftings and a state change time of particulary investigated devices. The research includes the most popular types of attacks. We use the decision tree algorithm for the construction of the chain of security events. The ROC analysis is used for analyzing the results of security events binary classification, which is found using developed approach. The experimental study allowed evaluating the efficacy of the developed model for network attacks in the telecommunication service providers infrastructure recognition. Experimental results show high accuracy of determining the popular type of attacks. This gives an advantage to reduce the response time to security incidents in a larger network.