Self-Organized Distributed Anomaly Detection System in Computer Systems Based on The Principal Components Method

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F25840886%3A_____%2F22%3AN0000013" target="_blank" >RIV/25840886:_____/22:N0000013 - isvavai.cz</a>

Result on the web

<a href="https://ceur-ws.org/Vol-3156/paper25.pdf" target="_blank" >https://ceur-ws.org/Vol-3156/paper25.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

Self-Organized Distributed Anomaly Detection System in Computer Systems Based on The Principal Components Method

Original language description

In order to solve the scientific problem of improving the efficiency of anomaly detection in computer systems, the manifestations of which are due to the effects of malicious software and computer attacks, a method and distributed anomaly detection systems were developed based on synthesis of self-organization and centralization principles. The results are the basis for creating distributed systems to detect computer attacks and malware. Also, they can be used to create such a class of intrusion detection system as a honeynet. As a result, the peculiarities of anomaly manifestation in computer systems under the conditions of malicious software operation and computer attacks in local computer networks are studied and modern methods of anomaly detection, their features and methods of creation and architecture of distributed systems are analyzed. The architecture model of the distributed anomaly detection system in computer systems has been improved, which synthesizes the requirements of distribution, centralization and self-organization, to create distributed systems and their components, which will operate under the leadership of one center distributed between different components and decide independently. the presence of an anomaly. To ensure the integrity of the distributed system, a method was developed to maintain the integrity of the self-organized distributed system to detect anomalies in computer systems, based on which the system could change its architecture without user intervention, and determine strategies for further work. To detect computer attacks and malware, the method of centralized detection of distributed anomalies by the main components search algorithm has been improved to reduce the dimensionality from the moment of receiving and sending data to the decision center of the system. The results were implemented in the appropriate software, with which detection experiments were conducted, which showed improved reliability in the detection of computer attacks and malicious software.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

N - Vyzkumna aktivita podporovana z neverejnych zdroju

Publication year

2022

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

3rd International Workshop on Intelligent Information Technologies and Systems of Information Security, IntelITSIS 2022

ISBN

—

ISSN

16130073

e-ISSN

—

Number of pages

23

Pages from-to

329-351

Publisher name

CEUR-WS

Place of publication

Khmelnytskyi

Event location

Khmelnytskyi

Event date

Mar 23, 2022

Type of event by nationality

EUR - Evropská akce

UT code for WoS article

—