Detection of attacks in the corporate network using the rules of fuzzy logic

Abstract

The problem of identifying possible attacks on corporate network resources is considered. An analysis of approaches to the detection of information security violations using fuzzy set theory is performed. It is shown that in order to increase the efficiency of detecting situations related to a possible invasion, it is necessary to use modern technologies of intellectual analysis using the rules and methods of fuzzy logic. A block diagram of a fuzzy system for detecting abnormal traffic in a network segment is proposed. In the expert system, the knowledge of experts is formalized in the form of a set of rules that allow you to make decisions in difficult situations. The analyst (knowledge engineer) is structuring the knowledge of experts in the form of a knowledge base. The rules-based expert system consists of a knowledge base, a inference mechanism, a result explanation unit and a user interface. For a particular corporate network there are characteristic traffic parameters that can be determined by accumulating statistical information on network behavior for any period of operation. The most important point in the procedure of fuzzy system synthesis is the selection and compilation of rules, or in other words, the synthesis of the table of linguistic rules of the system. The linguistic rules of the system are heuristically compiled by the developer, who is well informed about the technological features of the object. In the analytical description of the object, machine modeling of the developed system with iterative correction of linguistic rules is performed. In the absence of an analytical description of the object, the rules were adjusted immediately after the implementation of the system. According to the scheme, the analyzer performs diagnostics and filtering of the input data, the fafifier translates from numerical to linguistic form the corresponding data. The classifier analyzes the received input information determines the relevant situation in which the knowledge base, activating certain production rules. The defasifier translates from linguistic to digital form and generates a corresponding rule