ANALYSIS OF THE EFFECTIVENESS OF BORDER TRAFFIC ANOMALY DETECTION BASED ON MACHINE LEARNING MODELS

Abstract

Abstract. The article presents an approach to constructing a real-time anomaly detection model for DoS (Denial of Service) network traffic and its integration into a monitoring system. This opens new opportunities for visualization, investigation, and development of intrusion detection systems (IDS) and their digital twins, providing a flexible platform for modeling cyber-physical threats and responding to them. The study synthesizes a range of models with various neural network architectures, including CNN (Convolutional Neural Networks), LSTM (Long Short-Term Memory), and Autoencoder variants, performs a comparative analysis, and selects an effective model for predicting anomalies in network traffic using diverse metrics. The chosen model exchanges data with the Node-RED environment, which implements the traffic monitoring system and provides graphical representation of intrusion detection results, automated responses, and additional network traffic simulation. The model functions as a digital twin of the anomaly detection system. This approach enables the development of a prototype system that can be rapidly deployed without the need for complex computational resources or cluster systems. A key feature of the applied approach is the combination of modern neural network models with automated response logic, which allows its behavior to approximate that of an autonomous protection system capable of responding promptly to cyber-physical threats in real time. This significantly expands the capabilities of digital twins in education, testing, and development of modern cybersecurity systems, while also enhancing the effectiveness of research and practical implementations in the field of information security. The presented solution opens prospects for further integration of complex deep learning models, hybrid architectures, and automated network traffic monitoring systems.