METHOD FOR DETECTING ANOMALOUS NETWORK TRAFFIC Russian patent published in 2024 - IPC G06N3/08 G06F11/30 

FIELD: information security.

SUBSTANCE: effect is achieved by implementing a method that includes receiving network traffic for a selected period of time, recording parameters of network sessions, into a table of session parameters, digitizing the values of symbolic parameters of sessions, normalizing parameter values, forming a training and validation sample, forming a neural network with an autoencoder architecture, training neural network, calculating the anomaly threshold, receiving test traffic, receiving a test sample, submitting a test sample to the input of the neural network, calculating the reconstruction error for each session, obtaining a time series of average values of the final reconstruction errors for each session; dividing a time series into many time segments of equal duration; finding the average reconstruction error for each segment; identification as anomalous segments in which the average value of the reconstruction error is greater than the anomaly threshold, and, if necessary, generation of a report on anomalies detected in the test sample.

EFFECT: reduced number of errors of the first and second types when detecting traffic anomalies distributed over time.

1 cl, 5 tbl