RU2787078C1 - Method for detection of anomalies in operation of highly loaded network of automated telecommunication system - Google Patents

Abstract

FIELD: telecommunication.

SUBSTANCE: invention relates to detection of anomalies in the operation of a highly loaded network of an automated telecommunication system. Additional operations are introduced, based on reception and processing of a network traffic of formation of a dictionary of signals of reference frequency N-gram portraits of a normal and/or abnormal network traffic for each permissible pair of network nodes of the automated telecommunication system, where, ultimately, a user is provided with a possibility of marking of a formed frequency N-gram portrait as normal or abnormal, and the formed frequency N-gram portrait of the network traffic is added to the dictionary of signals of reference frequency N-gram portraits with an anomaly card.

EFFECT: detection of such anomalies, based on the analysis of frequency characteristics of a bit stream of a network traffic, without preliminary isolation of separate elements from it, and without the use of a multiagent model of this network.

1 cl, 1 dwg, 2 tbl

Description

The invention relates to security monitoring tools, namely, computer-based methods for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system and can be applied in network devices of telecommunication systems.

A known method for detecting computer attacks (1 - RF Patent No. 2683631, IPC: (2019.02) G06F 21/55, G06N 3/02. Method for detecting computer attacks. Patent holders - FGKVOUVO Military Academy of Communications of the Ministry of Defense of the Russian Federation, FGBUN Institute of Transport Problems of the Russian Academy of Sciences. Dementiev V E., Kireev S.Kh., Kotsynyak M.A., Lauta O.S., Malygin I.G. Publication - 03/29/2019), in which the threshold values of the parameters, the required number of defined types are set and stored attacks, for which the number of training and test cases for the neural network is set, characteristic vectors are prepared for each type of attack, protocol types and informative parameters for data packets are determined. Then the structure of the neural network is set, including input, hidden and output neurons, and its training is carried out using pre-prepared examples upon reaching the required recognition reliability. In the presence of a computer attack, a single or combined type of attack is determined by a combination of calculated parameter values on the output neurons of the neural network.

The method can be used to detect anomalies in the network of an automated telecommunications system.

The disadvantage of this method in this case is the impossibility of determining an unknown anomaly that was not recognized at the stage of neural network training.

Also known is a method for detecting anomalous behavior of a device in a computer system (2 - US patent No. US 20170230392 A1, G06F 21/55. Anomaly alert system for cyber thread detection / Tom Dean, Jack Stockdale; Pub 06/30/2020). This method includes detecting malicious activity and presenting anomaly detection results to a system user. Malicious activity detection includes collecting network traffic metrics, building a normal activity profile based on it, and analyzing the behavior of each network device in order to identify anomalies in its behavior. When collecting network traffic metrics, directly measured data network metrics are used as metrics (for example, the number of packets received and sent by a network device, the amount of transmitted and received data), as well as calculated metrics, which use the results of classical anomaly detection algorithms. input data (eg, support vector machine, local outlier). As a result, for each network device, a set of metrics assigned to it with a history of their measurements is formed. Then the Peak Over Threshold (POT) method is used to identify abnormal values of the current measurement of the observed parameter by calculating the probability and comparing this probability with some threshold value. If the observed probability value is below the threshold, then an anomaly in the network operation is fixed. Using the ROT method also allows you to automatically change the threshold values for the parameters of network devices, taking into account the history of parameter measurements. This allows modification of anomaly recognition models based on fixed data without operator participation. Presenting the results of anomaly detection for the system user includes ranking the observed events in the network according to the degree of influence on the anomaly in the operation of the network device, and displaying to the user those events whose contribution to anomaly detection exceeds the threshold value. This method can be used to detect anomalies in the network of an automated telecommunications system.

The disadvantage of the method in this case is the limited list of metadata, which reveals anomalies, which leads to an increase in the likelihood of errors of the first and second kind.

A known method for detecting cyber attacks in automated process control systems (3 - US patent No. US 10015188, H04L 63/1441. Method for mitigation of cyber attacks on industrial control systems / Omer Schneider, Nir Giller; Pub 03.07.2018). The method describes two modes: training and protection.

In the learning mode, network packets are intercepted, which are network traffic of industrial automation and control systems (APAC), and a characteristic vector is formed for each intercepted packet based on the parameters of such a packet. As packet parameters, protocol fields are used that can be detected by the Deep Packet Inspection (DPI) method, packet metadata (frequency, time, source and receivers, etc.), context-sensitive information associated with previous intercepted packages. Based on the characteristic vector of the package, a new observable state of the APAC is calculated, while the model of the protected APAC is considered as a finite automaton. The result of the calculation is the identification of the correspondence of the new state to one of the previously observed states or the conclusion that the new state was not previously detected and fixed. In the latter case, one more state and an edge are created for the finite automaton, corresponding to the transition of the system from the previous state to the new one. The weight for such an edge is taken as unity. If the new state was previously fixed, then for the edge corresponding to the transition from the previous state to the new one, the weight is increased by one. The learning mode is terminated when no new edges and states are created for the CAPS state machine.

In the protection mode, network packets are intercepted and a characteristic vector is formed for each of them, using the packet parameters in the same way as in the learning mode. On the basis of the characteristic vector, a new observed state of the PSAA is calculated, as a result of the calculation, an edge of the finite automaton connecting the previous and current state of the PSAA, as well as the weight of this edge, is determined. For an edge, the probability of transition from the previous to the current state is determined, while it is assumed that the higher the weight of the edge, the higher the transition probability. Additionally, the transition probability is calculated for a chain of several previous states. The values of the obtained probabilities are compared with the boundary values set in the learning mode. If the calculated value of the transition probability is below the corresponding limit value, then the operator is notified of the detection of an anomaly in the work protected by the ASA&C.

The disadvantage of this method is an unpredictably long training time and a high probability of occurrence of errors of the second kind (false negative positives), which makes it impossible to use it in cases where the network of the automated system is highly loaded.

A known method for detecting anomalies in the operation of an automated system network (4 - Patent of the Russian Federation No. 2738460, IPC: H04L 1/00 (2006.01), G06F 21/00 (2013.01). Antipinsky A.S., Domukhovsky N.A., Komarov D.E., Sinadsky A.N. Publication - 12/14/2020), taken as a prototype. For its implementation when used in a highly loaded network of an automated telecommunications system:

- a network packet intercepted in the network of an automated telecommunications system is received, address fields and data fields are detected in it based on the network packet parsing rules, while the address fields of the packet include the address and interface of at least one source node and the address and interface of at least one destination node;

- the address and interface of the sender node and the address and interface of the recipient node are identified based on the search in the catalog of interfaces of network nodes of the network of the automated telecommunication system for the identified pair "source node - destination node" find an entry in the signal dictionary, and the entry in the signal dictionary includes the addresses and interfaces of these nodes and the data fields of the received network packet;

- detecting the reaction of the recipient node to the detected entry of the signal dictionary and comparing this reaction with the expected reaction to this entry, set for the recipient node in the agent corresponding to it from the multi-agent network model of the automated telecommunications system;

- the anomaly card is returned to the user, while the anomaly card includes information that includes at least one of the types of information selected from the group: automatically generated rules for parsing a network packet, the structure of which was not known and for which address fields and data fields were not detected ; address and/or interface of the source node and/or the destination node not found in the catalog of interfaces of the network nodes of the network of the automated telecommunications system; the deviation between the observed and expected response to the entry of the signal dictionary in the event that such a deviation is detected for a given error value for the deviation;

- moreover, the multi-agent network model of the automated telecommunications system consists of software agents corresponding to the nodes of the network of the automated telecommunications system, for which their expected response at the output is determined when a signal dictionary entry is received at their input.

The prototype method allows you to detect anomalies in the network of an automated telecommunications system based on a multi-agent network model.

The disadvantage of the prototype method is the impossibility of its application in cases where the network of an automated telecommunications system is highly loaded, since the use of a multi-agent model of the network of an automated telecommunications system, consisting of software agents corresponding to the nodes of the network of an automated telecommunications system, to identify the expected response at the output for each pair of "node -source-destination node" in the received traffic requires large computing resources.

The technical problem is the lack of technical means for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system.

To solve a technical problem, a method is proposed for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system, in which a network packet intercepted in the network of an automated telecommunications system is received, address fields and data fields are identified in it based on the rules for parsing a network packet, while the address fields of the packet include the address and the interface of at least one source node and the address, and the interface of at least one recipient node, identify the address and interface of the sender node and the address and interface of the destination node based on a search in the catalog of interfaces of network nodes of the network of an automated telecommunication system, for the identified pair "source node - destination node", an entry is found in the signal dictionary, and the signal dictionary entry includes the addresses and interfaces of these nodes and the data fields of the received network packet, the anomaly card is returned to the user, while the anomaly card includes information including on at least one of the types of information selected from the group: the address and/or interface of the source node and/or the destination node.

According to the invention, additionally, on the basis of receiving and processing network traffic, a signal dictionary of reference N-gram frequency portraits of normal and/or abnormal network traffic is formed for each allowable pair of network nodes of an automated telecommunications system, in the process of receiving network packets and identifying addresses and interfaces, statistics are accumulated on network packets, after which, based on the processing of the accumulated network packets, the current frequency N-gram network traffic portrait of the "sender node" - "receiver node" pair is formed based on a comparison of the generated frequency portrait with reference frequency N-gram network traffic portraits from the dictionary signals form a set of similarity characteristics, compare them with a threshold value, when the anomaly card is returned to the user, it includes a set of similarity characteristics of the generated frequency N-gram portrait with the reference frequency N-gram portraits of network traffic nodes networks of an automated telecommunication system, after which they provide the user with the opportunity to mark the generated frequency N-gram pattern as normal or abnormal, add the generated frequency N-gram pattern of network traffic to the signal dictionary of reference N-gram frequency patterns with an anomaly card.

The technical result is the detection of anomalies in the operation of a highly loaded network of an automated telecommunications system, which is based on the analysis of the frequency characteristics of the bit stream of network traffic without prior separation of individual elements from it and without the use of a multi-agent model of this network.

The specified technical result is achieved through the introduction of new operations:

- based on the reception and processing of network traffic, the formation of a dictionary of signals of reference frequency N-gram portraits of normal and / or abnormal network traffic for each allowable pair of network nodes of an automated telecommunications system;

- accumulation of statistics on network packets;

- formation based on the processing of accumulated network packets of the current frequency N-gram portrait of the network traffic of the pair "sender node" - "receiver node";

- based on the comparison of the generated frequency portrait with the reference frequency N-gram portraits of network traffic from the dictionary of signals forming a set of similarity characteristics, comparing them with a threshold value;

- when the card is returned to the user, the anomalies include many characteristics of the similarity of the generated frequency N-gram portrait with the reference frequency N-gram portraits of the network traffic of the network nodes of the automated telecommunications system;

- providing the user with the ability to mark the generated frequency N-gram portrait as normal or abnormal;

- adding the generated frequency N-gram portrait of network traffic to the signal dictionary of reference frequency N-gram portraits with an anomaly card.

The figure shows a block diagram of a device that implements the proposed method for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system.

The combination of distinctive features and properties of the proposed method is not known from the literature, so it meets the criteria of novelty and inventive step.

The method for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system is implemented as follows:

1 Based on the reception and processing of network traffic, a dictionary of signals of reference frequency N-gram portraits of normal and/or abnormal network traffic is formed for each allowable pair of network nodes of an automated telecommunications system.

2 A network packet intercepted in the network of an automated telecommunications system is received, address fields and data fields are detected in it based on the network packet parsing rules, while the address fields of the packet include the address and interface of at least one source node and the address and interface of at least one destination node.

3 The address and interface of the sender node and the address and interface of the recipient node are identified based on the search in the catalog of interfaces of the network nodes of the network of the automated telecommunication system for the identified pair "source node - destination node" find an entry in the signal dictionary, and the entry in the signal dictionary includes the addresses and interfaces of these nodes and the data fields of the received network packet.

4 In the process of receiving network packets and identifying addresses and interfaces, accumulate statistics on network packets.

5 Based on the processing of the accumulated network packets, the current frequency N-gram portrait of the network traffic of the "sender node" - "receiver node" pair is formed.

6 Based on the comparison of the generated frequency portrait with the reference frequency N-gram portraits of network traffic from the signal dictionary, a set of similarity characteristics is formed and compared with a threshold value.

7 The anomaly card is returned to the user, wherein the anomaly card includes information including at least one of the types of information selected from the group:

7.1 address and/or interface of the source node and/or the destination node;

7.2 set of similarity characteristics of the formed frequency N-gram portrait with the reference frequency N-gram portraits of network traffic of network nodes of an automated telecommunications system.

8 Provide the user with the ability to mark the generated frequency N-gram pattern as normal or abnormal.

9 Add the formed frequency N-gram pattern of network traffic to the signal dictionary of reference frequency N-gram patterns with an anomaly card.

i=1,2,…,To implement point 1 based on received and processed network packets

i=1,2,…,

where i - package number;

- байт i-го пакета;

- byte of the i-th packet;

k _i - byte number in the packet;

a dictionary of signals of reference frequency N-gram portraits of normal and/or abnormal network traffic is formed for each j-th admissible pair of network nodes of an automated telecommunication system:

where E _j - j-th reference frequency N-gram portrait;

- значение частоты использования уникальной l-ой последовательности значащих символов

длиной не более N для j-го подмножества пакетов.

- the value of the frequency of using the unique l-th sequence of significant characters

length no more than N for the j-th subset of packets.

To implement point 2, as well as in the prototype method, they receive a network packet intercepted in the network of an automated telecommunications system

where i - package number;

b _ki - byte of the i-th packet;

k _i - byte number in the packet,

based on parsing rules, address fields and data fields are identified in it

where Ф is the parsing rule;

- адресные поля по меньшей мере одного узла-источника и одного узла-получателя;

- address fields of at least one source node and one destination node;

- байты адресных полей;

- bytes of address fields;

- данные;

- data;

- байты данных.

- data bytes.

i-го пакета выявляют адрес и интерфейс узла-отправителя и адрес, и интерфейс узла-получателя на основе поиска по каталогу интерфейсов сетевых узлов сети автоматизированной телекоммуникационной системы для выявленной пары "узел-источник - узел-получатель", т.е. выполняют

To implement paragraph 3 in the same way as in the prototype method, from the address fields

The address and interface of the source node and the address and interface of the destination node are identified based on the search in the catalog of interfaces of the network nodes of the automated telecommunications system network for the identified pair "source node - destination node", i.e. perform

where Ψ is a dictionary of signals;

- "узел-источник";

- "source node";

- "узел-получатель".

- "destination node".

To implement point 4, the set of intercepted packets

("узел-источник - узел-получатель"):

j=1,2,…,where I is the number of intercepted packets, divided into subsets for all detected j-th pairs

("source node - destination node"):

j=1,2,…,

- количество пакетов в подмножестве j;where

- number of packages in subset j;

j - subset number.

, где С - минимально допустимое количество пакетов в подмножестве.In this case, the subset is considered formed if the condition

, where C is the minimum allowed number of packets in the subset.

To implement paragraph 5, the frequency N-gram portrait of the network traffic of the j-th pair of "sender node" - "receiver node" is represented as a set of values of absolute or relative frequencies of use of unique sequences of significant characters with a length of no more than N for the j-th subset

, где I(N) - количество уникальных последовательностей.Bit values, byte tetrads, byte values, etc. can be used as significant characters. In particular, if byte values are chosen as significant characters, then the possible significant characters are in the interval [0, 256[. Then the number of unique sequences of significant characters of length no more than N can be calculated by the formula

, where I(N) is the number of unique sequences.

Let's denote all unique sequences of significant characters of length no more than N:

подсчитывается количество использований N-грамм

For each j-th subset

the number of uses of N-grams is counted

Then the value of the frequencies of using unique sequences of significant symbols for each j-th subset is determined by the expression:

and the frequency N-gram portrait for each j-th subset by the expression:

To implement paragraph 6, perform based on the comparison of all j-th frequency N-gram portraits (G _j ) with the j-th reference portraits (E _j ).

For this, a set of similarity characteristics is formed. These may include Pearson's cross-correlation coefficient, least squares similarity score, or other similarity characteristics. The power of the set of similarity characteristics must be at least 1.

If the Pearson cross-correlation coefficient is chosen as the similarity characteristic, then it is calculated by the expressions:

where κ _j is the cross-correlation coefficient, which in this case is a similarity characteristic, and the set of characteristics consists of one element: X={κ _j }.

Frequency N-gram portraits G _j and E _j are considered similar if the condition κ _j ≥e _j is satisfied for X, consisting of one element, where e _j is the threshold value for the j-th standard.

считается аномальным. В этом случае так же, как и в способе-прототипе, возвращают пользователю карточку аномалии, при этом карточка аномалии включает в себя сведения, включающие по меньшей мере один из видов сведений, выбранных из группы:To implement point 7, the condition κ _j <e _j is checked. If the condition is met, then the j-th subset of packages

considered anomalous. In this case, as well as in the prototype method, the anomaly card is returned to the user, while the anomaly card includes information including at least one of the types of information selected from the group:

- address and/or interface of the source node and/or the destination node;

- a set of similarity characteristics of the generated frequency N-gram portrait with reference frequency N-gram portraits of network traffic of network nodes of an automated telecommunications system.

To implement point 8, according to the user's decision, actions are performed on the frequency N-gram portrait or threshold value. Namely, if the user decides that there is no anomaly, then he can change the threshold value or correct the reference frequency portrait, otherwise he fixes the anomaly for the addresses and/or interfaces of the source node and/or the destination node.

или средневзвешенное.To implement point 9, provided that the user has decided to correct the reference N-gram frequency portrait, he can replace the current reference frequency portrait with a new one G _j → E _j , recalculate E _j taking into account G _j , for example, calculate the arithmetic mean:

or weighted average.

The proposed method has the following distinguishing features in the sequence of its implementation from the prototype method, which are presented in table 1.

From the presented table 1 comparing the implementation sequences of the prototype method and the proposed method, it can be seen that in the proposed method, relative to the prototype method, additionally, based on the reception and processing of network traffic, a dictionary of signals of reference frequency N-gram portraits of normal and/or abnormal network traffic is formed for of each admissible pair of network nodes of an automated telecommunications system, in the process of receiving network packets and identifying addresses and interfaces, statistics on network packets are accumulated, after which, based on the processing of accumulated network packets, the current frequency N-gram portrait of the network traffic of the pair "sender-node" is formed - " recipient node", based on the comparison of the generated frequency portrait with the reference frequency N-gram portraits of network traffic from the signal dictionary, a set of similarity characteristics is formed, compared with the threshold value, when the anomaly card is returned to the user, it is turned on a set of similarity characteristics of the generated N-gram frequency portrait with the reference N-gram frequency portraits of network traffic of the network nodes of the automated telecommunication system are determined, after which they provide the user with the opportunity to mark the generated N-gram frequency portrait as normal or abnormal, add the generated N-gram frequency portrait of the network traffic to the dictionary of signals of reference frequency N-gram portraits with an anomaly card.

The block diagram of the device that implements the proposed method is shown in the figure. The device includes:

01 - network packet interception module (MPSP);

02 - module for processing network packets and extracting address information (MOPIVAI);

03 - module for generating statistics and frequency N-gram portraits (MFSIChP);

04 - module for comparing frequency N-gram portraits (MSChP);

05 - base of reference frequency N-gram portraits (BECHP);

06 - control module (MU);

07 - input output module (MVV).

Input MSSP 01 is connected to the network of an automated telecommunications system. The output of MPSP 01 is connected to the input of MOPiVAI 02. The output of MOPiVAI 02 is connected to the input of MFSiChP 03. The output of MFSiChP 03 is connected to the first input of MSChP 04. The output of MSChP 04 is connected to the first input of MU 06. The first output of MU 06 is connected to the input of BECHP 05. The output of BECHP 05 is connected to the second input of MSCHP 04. The second output of MU 06 is connected to the input of MBB 07. The output of MBB 07 is connected to the second input of MU 06.

MPSP 01 intercepts network packets in the network of an automated telecommunications system and transmits them to the input of MOPiVAI 02. MOPiVAI 02 processes and detects address fields and data fields in them based on the rules for parsing a network packet. For each network packet MOPiVAI 02 detects the addresses and interfaces of the sender nodes and addresses and interfaces of the recipient nodes based on the search in the catalog of interfaces of the network nodes of the automated telecommunications system network for the identified pair "source node - destination node". The identified pairs "source-source - host-receiver" and the intercepted network packets are transmitted to the input of MFSiChP 03. MFSiChP 03 divides network packets into groups according to the identified pairs "source-source - destination node" and accumulates statistics for each group until until it has accumulated the minimum allowable number of packets for the group. Upon completion of the accumulation, MFSICHP 03 generates a frequency N-gram portrait and transmits it and a pair of "source-source - node-receiver" to the input of MSCHP 04. MSChP 04 requests a reference frequency N-gram portrait in BECHP 05 for a pair of "node-source - node -recipient". If the reference frequency N-gram portrait is found in the BECHP 05, then the MSCHP 04 compares the generated frequency portrait with the reference one, generates a set of similarity characteristics and compares them with the threshold value. If the similarity characteristics do not exceed the threshold value, then an anomaly is detected, in this case, MUSP 04 issues an anomaly card to the first input of MU 06 (address and / or interface of the source node and / or recipient node and a set of similarity characteristics of the generated frequency N-gram portrait with reference frequency N-gram portraits of network traffic of network nodes of an automated telecommunications system). If the standard is not found in BECHP 05, then the current frequency N-gram portrait is automatically added to BECHP 05. MU 06 provides interaction between MUCHP 04, BECHP 05 and MVM 07. MVM 07 provides interaction with the User, returns anomaly cards to him and receives commands from him management.

Let us give an example of using the method for a pair "source node - destination node", in which there is no anomaly (pair A), and for a pair in which there is an anomaly (pair B).

Performing the steps of paragraph 1, we will form the reference frequency N-gram portraits for pairs A and B, i.e. we will intercept at least C=1000 packets for each pair, we assume that the length of the sequences of significant characters will be equal to N=1. Byte values will be used as significant characters, then the number of unique sequences of significant characters is I(N)=256.

We will form frequency portraits, counting the number of uses of all byte values for all intercepted network packets of pairs A and B, and save them, respectively, in signal dictionaries as reference ones (Table 2).

Let's carry out one more interception in the network of an automated telecommunication system of network packets for previously selected pairs A and B and, following steps 2-5, we will also form frequency N-gram portraits (Table 2). Performing paragraph 6, we compare the generated frequency N-gram portraits for pairs A and B with the reference ones, respectively, and form a set of similarity characteristics. We will choose 0.9 as the threshold value.

In this example, the set of similarity features consists of a single element, Pearson's cross-correlation coefficient (CCC).

The CVC between the reference and frequency N-gram portrait for pair A is 0.97976, which is more than the threshold value, based on this, it is concluded that there is no anomaly.

CVC between the reference and frequency N-gram portrait for pair B is 0.46552, which is less than the threshold value, based on this, it is concluded that the anomaly has been detected. Performing steps 7-9, the user is provided with: an anomaly card, the ability to mark the generated frequency N-gram pattern as normal or abnormal, the ability to add it to the signal dictionary of reference N-gram frequency patterns with an anomaly card.

Thus, the proposed method, relative to the prototype method, makes it possible to implement anomaly detection in the operation of a highly loaded network of an automated telecommunication system, which is based on the analysis of the frequency characteristics of the bit stream of network traffic without first extracting individual elements from it and without using a multi-agent model of this network.

Claims (1)

A method for detecting anomalies in the operation of a highly loaded network of an automated telecommunications system, in which a network packet intercepted in the network of an automated telecommunications system is received, address fields and data fields are detected in it based on the rules for parsing a network packet, while the address fields of the packet include an address and an interface of at least of one source node and the address and interface of at least one recipient node, identify the address and interface of the sender node and the address and interface of the recipient node based on a search in the catalog of interfaces of network nodes of the network of an automated telecommunications system, for the identified pair of "node- source - destination node" find an entry in the signal dictionary, and the signal dictionary entry includes the addresses and interfaces of these nodes and the data fields of the received network packet, return the anomaly card to the user, while the anomaly card includes information including at least one of the types information selected from the group: address and / or interface of the source node and / or the recipient node, characterized in that, additionally, on the basis of receiving and processing network traffic, a dictionary of signals of reference frequency N-gram portraits of normal and / or abnormal network traffic is formed for each allowable pair network nodes of an automated telecommunications system, where frequency N-gram portraits are presented as a set of values of absolute or relative frequencies of use of unique sequences of significant characters with a length of not more than N for the j-th subset of network packets, statistics are accumulated in the process of receiving network packets and identifying addresses and interfaces by network packets, after which, based on the processing of the accumulated network packets, the current frequency N-gram portrait of the network traffic of the pair "sender node" - "receiver node" is formed based on a comparison of the generated frequency portrait with reference frequency N-gram portraits of network traffic from dictionary with signals form a set of similarity characteristics, compare them with a threshold value, when the anomaly card is returned to the user, it includes a set of similarity characteristics of the generated N-gram frequency portrait with the reference N-gram frequency portraits of the network traffic of the network nodes of the automated telecommunication system, after which the user is given the opportunity to mark of the generated frequency N-gram pattern as normal or abnormal, the generated frequency N-gram pattern of network traffic is added to the signal dictionary of the reference frequency N-gram patterns with an anomaly card.

Images