V. А. Chastikova , К.V. Kozachek , Е.S. Korobskaya , V. P. Kravtsov
229-243
2025-11-10
Abstract ▼
The article focuses on the study of user behavior and the creation of behavioral models. This helps to improve the accuracy of anomaly detection and quickly identify non-standard network activity. The purpose of this study is to compare the effectiveness of two machine learning models – the multilayer perceptron (MLP) and the Random Forest algorithm – for detecting cyber intrusions based on the analysis of network traffic and user behavior. Behavioral models make it possible to detect deviations from normal user activity and network interactions, which significantly increases the completeness of cyber intrusion detection. The study used the UNSW-NB15 dataset, which includes current types of attacks and characteristics of both network traffic and user activity. Prior to the implementation of the models, preliminary data processing, feature selection, normalization and coding of categorical features were carried out. The models were evaluated using various metrics such as accuracy, recall, AUC-ROC, precision, F1-score, and others. The results of the study showed that the Random Forest algorithm provides high classification accuracy (95%), and the multilayer perceptron (MLP), in turn, achieved outstanding results in AUC (0.9830) and accuracy (precision, 0.9869). The paper presents an analysis and characterization of methods for analyzing user behavior and classifying network traffic, a comparison of data sets for intrusion detection systems (IDS), and practical recommendations for choosing models depending on operating conditions. The results of the study can be useful in the development of adaptive protection systems that combine high accuracy and speed
Intruder recognition in uncontrolled environments is a critical function of biometric-based security control systems (SCS), ensuring protection at facilities with large crowds. The accuracy of such systems can be improved by combining multiple biometric traits extracted from video imagery. However, processing video data involves several challenges, including viewpoint variation, occlusion, and selecting an appropriate feature fusion level. To resolve these challenges, a complete approach to intruder recognition is proposed. The approach is based on video preprocessing, the combination of two convolutional neural networks (CNNs), Dempster–Shafer theory, and the random forest method. These techniques fuse behavioral biometric features at the score level to classify video sequences. Gait and gestural behavior are selected as biometric modalities, as they can be captured without direct subject interaction. For the classification task, three classes of video data are defined: class 1 – person is not intruder, class 2 – a potential intruder, class 3 – intruder. The study also presents a general architecture for the proposed approach, along with a detailed description of its processing stages. The effectiveness of the approach is measured through experiments performed on the KTH dataset, which comprises six types of simple human actions performed by different subjects under different background conditions. Experimental results show that the proposed approach improves intruder recognition accuracy in uncontrolled environments, achieving an 87 % classification rate.
