Network Anomalies Detection Approach Based on Weighted Voting

Abstract

To avoid information systems malfunction, their integrity disruption, availability violation as well as data confidentiality, it is necessary to detect anomalies in information system operation as quickly as possible. The anomalies are usually caused by malicious activity – information systems attacks. However, the current approaches to detect anomalies in information systems functioning have never been perfect. In particular, statistical and signature-based techniques do not allow detection of anomalies based on modifications of well-known attacks, dynamic approaches based on machine learning techniques result in false responses and frequent anomaly miss-outs. Therefore, various hybrid solutions are being frequently offered on the basis of those two approaches. The paper suggests a hybrid approach to detect anomalies by combining computationally efficient classifiers of machine learning with accuracy increase due to weighted voting. Pilot evaluation of the developed approach proved its feasibility for anomaly detection systems.