V. А. Chastikova , К.V. Kozachek , Е.S. Korobskaya , V. P. Kravtsov
229-243
2025-11-10
Abstract ▼
The article focuses on the study of user behavior and the creation of behavioral models. This helps to improve the accuracy of anomaly detection and quickly identify non-standard network activity. The purpose of this study is to compare the effectiveness of two machine learning models – the multilayer perceptron (MLP) and the Random Forest algorithm – for detecting cyber intrusions based on the analysis of network traffic and user behavior. Behavioral models make it possible to detect deviations from normal user activity and network interactions, which significantly increases the completeness of cyber intrusion detection. The study used the UNSW-NB15 dataset, which includes current types of attacks and characteristics of both network traffic and user activity. Prior to the implementation of the models, preliminary data processing, feature selection, normalization and coding of categorical features were carried out. The models were evaluated using various metrics such as accuracy, recall, AUC-ROC, precision, F1-score, and others. The results of the study showed that the Random Forest algorithm provides high classification accuracy (95%), and the multilayer perceptron (MLP), in turn, achieved outstanding results in AUC (0.9830) and accuracy (precision, 0.9869). The paper presents an analysis and characterization of methods for analyzing user behavior and classifying network traffic, a comparison of data sets for intrusion detection systems (IDS), and practical recommendations for choosing models depending on operating conditions. The results of the study can be useful in the development of adaptive protection systems that combine high accuracy and speed
