Architecture of a Multistage Anomaly Detection System in Computer Networks

Abstract

The operation of anomaly detection systems in modern computer networks, as a rule, is associated with the processing of large amounts of traffic. With the increase in the scale of computer networks and the growing complexity of network attacks, it becomes necessary to detect multi-stage attacks in real time. This paper presents the architecture of a multi-stage anomaly detection system. The features of the system are the use of generative adversarial neural networks and the minimization of processed traffic using an attacker’s behavior model. The described architecture has a multilevel structure and allows monitoring in distributed computer networks.