Adaptive Profiling of Computer Network Users with a Hybrid SARIMA-ANFIS Approach
Jakub Nowak, Marcin Korytkowski, Magdalena M. Scherer · Procedia Computer Science · 2025
The increase in threats to network infrastructure is closely linked to the need for developing new, advanced, and efficient methods for protecting IT infrastructure, particularly the information stored within it. Security techniques must continuously adapt to dynamically changing conditions in the environment, such as new protocols, applications, and user behaviors. We present a hybrid modular system that utilizes SARIMA and ANFIS algorithms, as well as One Class classifier structures based on convolutional networks, designed to detect anomalies using network user profiles built from frewall event data. This model has been adapted for recognizing and classifying network data for 280 different users, achieving a high accuracy of 78%. Unlike traditional solutions, the presented system combines the analysis of both linear and nonlinear patterns. The information sources include events containing data on visited URLs, website categories, activity time, protocols, and the amount of transmitted data. The integration of the SARIMA model, responsible for capturing data trends, with the adaptive ANFIS system enables more accurate forecasting and identification of user behaviors. The system operates in real-time, allowing for rapid response to potential threats and enhancing network security by dynamically adapting to changes in user activity. This solution can be applied in various environments where continuous monitoring and user authorization are crucial; from corporate internal networks to public organizations with specific data security requirements. Our research demonstrates that the ARIMA-ANFIS hybrid model is an effective tool for behavioral profiling, integrating large-scale data analysis and the scalability needed to manage dynamically evolving network environments.