THE METHODS OF DATA STORING OF A RECOMMENDATION SYSTEM BASED ON LINKED LISTS

Abstract

The goal of this work is to develop a system for detecting cyber threats based on the analysis of network traffic data of web resources using Python programming language and using machine learning methods. The object of research is the process of analyzing data from web resources in cybersecurity systems. The subject of research is the methods and algorithms of machine learning for the analysis of data from web resources. CSE-CIC-IDS2017 open data set was chosen to train the developed model of cyberattack detection, which contains the most modern common information attacks that correspond to the real world data, the main implemented attacks include FTP brute force, SSH brute force, DoS, Heartbleed, web attack , infiltration, botnet and DDoS. The developed software for detecting cyberattacks on websites consists of several modules, namely: a module for data processing pre-processing, a module for researching the feature space of network traffic and a module for using machine learning algorithms to search for cyberattacks. To solve the problem of selection of features in the implementation of this software, it was decided to choose a selection strategy based on the model using one of the ensemble methods of machine learning random forest. Model-based feature selection uses a machine learning algorithm with the teacher to calculate the importance of each feature, leaving only the most important ones. The following machine learning algorithms were chosen to train the model: naive Bayesian classifier, k-nearest neighbors, decision trees, support vector machine (SVM) with using Gaussian basis, and decision trees with acceleration (gradient boosting). Along with the training, a cross-check (with control) was performed on seven blocks at once, in order to obtain a more accurate assessment of the generalization ability of the model. The result of this work is the software implementation of machine learning methods to detect cyber-attacks on websites by identifying their features in network traffic, as well as comparing their effectiveness.