STUDY OF THE APPLICATION OF NEURAL NETWORKS FOR DETECTION OF LOW-INTENSE DDoS ATTACKS OF THE APPLICATION LEVEL

The article discusses the experience of using artificial neural networks to detect low-intensity (low power) distributed computer denial-of-service attacks implemented at the application level. The features of popular computer denial-of-service attacks, in particular RUDY, SlowLoris and variations of HTTP-flood, are considered. The relevance of attacks imitating the actions of legitimate users on web portals is noted. It is shown that the use of traditional means of detecting and countering large-scale cyber-attacks to denial of service is inefficient or economically unprofitable. Recommendations are given to reduce the level of false positives. Various scenarios of low-intensity distributed computer attacks are considered. A hybrid neural network is proposed to detect distributed computer denial of service attacks. Conceptual models of the event source component and the delay generation component have been developed. A method and a general technique for detecting low-intensity computer denial-of-service attacks has been developed. An experimental study on the use of neural network approaches is presented.