Detection of network intelligence features with the decision tree model

Abstract

O b j e c t i v e s .  Early detection of network intelligence allows to reduce the risks of information security of organizations. The study was carried out to develop software module for detecting the features of network intelligence by machine learning methods.

M e t h o d s . Analysis of open datasets of appropriate destination; formation of metrics characteristic of network intelligence; development of a dataset based on certain metrics; study of the effectiveness of machine learning methods for classification task.

R e s u l t s .  The  topology was  designed and  a  test  segment  was  created  in  the  corporate  network of RUE "Beltelecom" to create a dataset. A monitoring tool has been developed for detecting and analyzing the events, the results of which were used as the basis for a new dataset.

The implementation of the decision tree method in the form of program code allowed to increase the speed of the module by about 2 times (0,147 ms). Practical tests of the developed module have shown the alarm on all types of network scanning using Nmap and Masscan utilities.

Co n c l u s i o n. The analysis of the dataset by principal component method showed the presence of a border area between  the  events  of  legal  traffic  and  network  intelligence  traffic,  which  had  a  positive  effect  on  the training of the model. The most promising machine learning methods have been studied and tested using various hyperparameters. The best results were shown by the decision tree method with the parameters criterion = gini and splitter = random and speed as 0,333 ms.