Investigation of the Method for Identifying Cyberattacks Based on Analysis of the State of Network Nodes

Abstract

This study is aimed at building a model of attack detection based on the analysis of chains of states of network nodes. The proposed model allows us to determine the speed and acceleration of state change for a particular type of network attack at a given time. On the basis of the revealed patterns of changes in the States of network nodes, the study of chains of network events to identify the type of attacks. As part of the experimental study, the effectiveness of the developed model of attack recognition in the network of telecommunications service providers was evaluated, which shows a sufficiently high accuracy of determining the class of suspicious activity.