kaz44Вестник Университета Шакарима. Серия технические наукиBulletin of Shakarim University. Technical Sciences2788-79953006-0524«Шәкәрім университеті» КеАҚ10.53360/2788-7995-2025-2(18)-2kaz44-1689Research ArticleАВТОМАТИЗАЦИЯ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИ (ОРИГИНАЛЬНАЯ СТАТЬЯ)AUTOMATION AND INFORMATION TECHNOLOGY (ORIGINAL ARTICLE)ПРИМЕНЕНИЕ МАШИННОГО ОБУЧЕНИЯ ДЛЯ АНАЛИЗА КИБЕРАТАК: ИССЛЕДОВАНИЕ НА ОСНОВЕ ДАТАСЕТА RT-IOT 2022THE USE OF MACHINE LEARNING TO ANALYZE CYBER ATTACKS: A STUDY BASED ON THE RT-IGOR 2022 DATASEThttps://orcid.org/0000-0003-1768-064XАдилжановаС.AdilzhanovaS.

Салтанат Альмуханбетовна Адилжанова – доктор технических наук, преподаватель кафедры криптологии и кибербезопасности факультета информационных технологий,

050040 г. Алматы, пр. аль-Фараби, 71

Saltanat Adilzhanova – doctor of technical sciences, lecturer at the department of Cryptology and Cybersecurity of the Faculty of Information Technology,

050040 Almaty, al-Farabi Ave., 71

asaltanat81@gmail.comhttps://orcid.org/0000-0002-5648-4476КунелбаевМ.KunelbayevM.

Мурат Кунелбаев – старший научный сотрудник Института информационных и вычислительных технологий Министерства науки и высшего образования Республики Казахстан,

050040 г. Алматы, пр. аль-Фараби, 71

Murat Kunelbayev – senior research fellow at the Institute of Information and Computational Technologies of the Ministry of Science and Higher Education of the Republic of Kazakhstan,

050040 Almaty, al-Farabi Ave., 71

murat7508@yandex.kzhttps://orcid.org/0009-0003-4684-5586СыбановаД.SybanovaD.

Дана Даулетовна Сыбанова – аналитик в сфере информационной безопасности, магистрантка кафедры криптологии и кибербезопасности факультета информационных технологий,

050040 г. Алматы, пр. аль-Фараби, 71

Dana Sybanova – cybersecurity analyst, master's student at the department of Cryptology and Cybersecurity of the Faculty of Information Technology,

050040 Almaty, al-Farabi Ave., 71

dsybanovaa@gmail.comКазахский национальный университет имени аль-ФарабиКазахстанAl-Farabi Kazakh National UniversityKazakhstan20250807202502(18)1323Copyright © Адилжанова С., Кунелбаев М., Сыбанова Д., 20252025Адилжанова С., Кунелбаев М., Сыбанова Д.Adilzhanova S., Kunelbayev M., Sybanova D.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://tech.vestnik.shakarim.kz/jour/article/view/1689

Статья посвящена исследованию применения машинного обучения для анализа кибератак. В исследовании рассматриваются алгоритмы Random Forest, SVM и Logistic Regression, которые успешно справляются с задачами выявления аномалий и минимизации ложных срабатываний. Адаптация моделей к работе с несбалансированными данными, таких как использование LabelEncoder для категориальных признаков и StandardScaler для стандартизации данных, позволила значительно улучшить их производительность. На основе анализа данных из набора «Real-Time Internet of Things (RT-IoT 2022)» представлены результаты точности и устойчивости моделей. Основное внимание уделяется защите от киберугроз, включая утечки информации, DDoS-атаки и другие виды угроз. Анализ различных алгоритмов машинного обучения для исследования кибератак показал значимые результаты. Random Forest продемонстрировала наивысшую точность – 99,86%, обеспечивая высокую стабильность и эффективность в классификации различных видов угроз. SVM показала точность 99,29%, справляясь с большинством сложных классов. Logistic Regression продемонстрировала удовлетворительные результаты с точностью 97,71%, хотя в некоторых редких случаях точность была ниже. Таким образом, Random Forest и SVM продемонстрировали наилучшую эффективность для задач безопасности и анализа кибератак в цифровых системах, обеспечивая высокую точность и надежность. В дальнейшем планируется внедрение более сложных методов, таких как глубокое обучение, для более точного определения и анализа угроз.

The article is devoted to the study of the use of machine learning for the analysis of cyber attacks. The study examines Random Forest, SVM and Logistic Regression algorithms, which successfully cope with the tasks of detecting anomalies and minimizing false positives. Adapting models to work with unbalanced data, such as using LabelEncoder for categorical features and StandardScaler for data standardization, has significantly improved their performance. Based on the analysis of data from the «Real-Time Internet of Things (RT-IoT 2022)» set, the results of the accuracy and stability of the models are presented. The main focus is on protecting against cyber threats, including information leaks, DDoS attacks, and other types of threats. An analysis of various machine learning algorithms for cyberattack research has shown significant results. Random Forest has demonstrated the highest accuracy – 99,86%, providing high stability and efficiency in classifying various types of threats. SVM showed an accuracy of 99,29%, coping with most complex classes. Logistic Regression showed satisfactory results with an accuracy of 97,71%, although in some rare cases the accuracy was lower. Thus, Random Forest and SVM have demonstrated the best performance for security and cyberattack analysis tasks in digital systems, providing high accuracy and reliability. In the future, it is planned to introduce more sophisticated methods, such as deep learning, to more accurately identify and analyze threats.

кибератакаалгоритмы машинного обученияRandom ForestSVMLogistic RegressionRT-IoT 2022обнаружение атакCyberattackmachine learning algorithmsRandom ForestSVMLogistic RegressionRT-IoT 2022аttack detectionReferencesRule-Based With Machine Learning IDS for DDoS Attack Detection in Cyber-Physical Production Systems (CPPS) / A. Hussain et al // IEEE Access. – 2024. – vol. 12. – Р. 3445261. https://doi.org/10.1109/ACCESS.2024.3445261.Rule-Based With Machine Learning IDS for DDoS Attack Detection in Cyber-Physical Production Systems (CPPS) / A. Hussain et al // IEEE Access. – 2024. – vol. 12. – Р. 3445261. https://doi.org/10.1109/ACCESS.2024.3445261.An Efficient Hybrid-DNN for DDoS Detection and Classification in Software-Defined IIoT Networks / A. Zainudin et al // IEEE Internet of Things Journal. – 2023. – vol. 10, № 10.An Efficient Hybrid-DNN for DDoS Detection and Classification in Software-Defined IIoT Networks / A. Zainudin et al // IEEE Internet of Things Journal. – 2023. – vol. 10, № 10.A Hybrid Machine-Learning Ensemble for Anomaly Detection in Real-Time Industry 4.0 Systems / D. Velásquez et al // IEEE Access. – 2022. – vol. 10. – Р. 3188102. https://doi.org/10.1109/ACCESS.2022.3188102.A Hybrid Machine-Learning Ensemble for Anomaly Detection in Real-Time Industry 4.0 Systems / D. Velásquez et al // IEEE Access. – 2022. – vol. 10. – Р. 3188102. https://doi.org/10.1109/ACCESS.2022.3188102.Toward a Human-Cyber-Physical System for Real-Time Anomaly Detection / B. Bajic et al // IEEE Systems Journal. – 2024. – vol. 18, № 2.Toward a Human-Cyber-Physical System for Real-Time Anomaly Detection / B. Bajic et al // IEEE Systems Journal. – 2024. – vol. 18, № 2.Mienye I.D. Deep Learning for Credit Card Fraud Detection: A Review of Algorithms, Challenges, and Solutions / I.D. Mienye, N. Jere // IEEE Access. – 2024. – vol. 12. – Р. 3426955. https://doi.org/10.1109/ACCESS.2024.3426955.Mienye I.D. Deep Learning for Credit Card Fraud Detection: A Review of Algorithms, Challenges, and Solutions / I.D. Mienye, N. Jere // IEEE Access. – 2024. – vol. 12. – Р. 3426955. https://doi.org/10.1109/ACCESS.2024.3426955.Machine and Deep Learning for Digital Twin Networks: A Survey / B. Qin et al // IEEE Internet of Things Journal. – 2024. – vol. 11, № 21.Machine and Deep Learning for Digital Twin Networks: A Survey / B. Qin et al // IEEE Internet of Things Journal. – 2024. – vol. 11, № 21.Cybersecurity Threats and Mitigation Measures in Agriculture 4.0 and 5.0 / C. Maraveas et al // Smart Agricultural Technology. – 2024. – vol. 9. https://doi.org/10.1016/j.atech.2024.100616.Cybersecurity Threats and Mitigation Measures in Agriculture 4.0 and 5.0 / C. Maraveas et al // Smart Agricultural Technology. – 2024. – vol. 9. https://doi.org/10.1016/j.atech.2024.100616.Credit Card Fraud Detection Using State-of-the-Art Machine Learning and Deep Learning Algorithms / F.K. Alarfaj et al // IEEE Access. – 2022. – vol. 10. – Р. 3166891. https://doi.org/10.1109/ACCESS.2022.3166891.Credit Card Fraud Detection Using State-of-the-Art Machine Learning and Deep Learning Algorithms / F.K. Alarfaj et al // IEEE Access. – 2022. – vol. 10. – Р. 3166891. https://doi.org/10.1109/ACCESS.2022.3166891.A Fraud Detection System in Financial Networks Using AntiBenford Subgraphs and Machine Learning Algorithms / R.K. Somkunwar et al // in 2023 International Conference on Ambient Intelligence, Knowledge Informatics and Industrial Electronics (AIKIIE). – 2023. https://doi.org/10.1109/AIKIIE60097.2023.1039032.A Fraud Detection System in Financial Networks Using AntiBenford Subgraphs and Machine Learning Algorithms / R.K. Somkunwar et al // in 2023 International Conference on Ambient Intelligence, Knowledge Informatics and Industrial Electronics (AIKIIE). – 2023. https://doi.org/10.1109/AIKIIE60097.2023.1039032.Monamo P. Unsupervised Learning for Robust Bitcoin Fraud Detection / P. Monamo, V. Marivate, B. Twala // in 2016 IEEE Conference. – 2016. https://doi.org/10.1109/XXXX.2016.XXXXXXX.Monamo P. Unsupervised Learning for Robust Bitcoin Fraud Detection / P. Monamo, V. Marivate, B. Twala // in 2016 IEEE Conference. – 2016. https://doi.org/10.1109/XXXX.2016.XXXXXXX.Chatterjee J. Digital Trust in Industry 4.0 & 5.0: Impact of Frauds / J. Chatterjee, M. Damle, A. Aslekar // in Proceedings of the 7th International Conference on Intelligent Computing and Control Systems (ICICCS-2023). – 2023. https://doi.org/10.1109/ICICCS56967.2023.10142925.Chatterjee J. Digital Trust in Industry 4.0 & 5.0: Impact of Frauds / J. Chatterjee, M. Damle, A. Aslekar // in Proceedings of the 7th International Conference on Intelligent Computing and Control Systems (ICICCS-2023). – 2023. https://doi.org/10.1109/ICICCS56967.2023.10142925.DIAVA: A Traffic-Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data / H. Gu et al // IEEE Transactions on Reliability. – 2020. – vol. 69, № 1.DIAVA: A Traffic-Based Framework for Detection of SQL Injection Attacks and Vulnerability Analysis of Leaked Data / H. Gu et al // IEEE Transactions on Reliability. – 2020. – vol. 69, № 1.Mienye I.D. A Deep Learning Ensemble With Data Resampling for Credit Card Fraud Detection / I.D. Mienye, Y. Sun, // IEEE Access. – 2023. – vol. 11. – Р. 3262020. https://doi.org/10.1109/ACCESS.2023.3262020.Mienye I.D. A Deep Learning Ensemble With Data Resampling for Credit Card Fraud Detection / I.D. Mienye, Y. Sun, // IEEE Access. – 2023. – vol. 11. – Р. 3262020. https://doi.org/10.1109/ACCESS.2023.3262020.Cyber Threat Predictive Analytics for Improving Cyber Supply Chain Security / Yeboah-Ofori A.Y.O.F.et al // IEEE Access. – 2021. – vol. 9. – Р. 3087109. https://doi.org/10.1109/ACCESS.2021.3087109.Cyber Threat Predictive Analytics for Improving Cyber Supply Chain Security / Yeboah-Ofori A.Y.O.F.et al // IEEE Access. – 2021. – vol. 9. – Р. 3087109. https://doi.org/10.1109/ACCESS.2021.3087109.Enhancing DDoS Attack Detection and Mitigation in SDN Using an Ensemble Online Machine Learning Model / A.A. Alashhab et al // IEEE Access. – 2024. – vol. 12. Р. 3384398. https://doi.org/10.1109/ACCESS.2024.3384398.Enhancing DDoS Attack Detection and Mitigation in SDN Using an Ensemble Online Machine Learning Model / A.A. Alashhab et al // IEEE Access. – 2024. – vol. 12. Р. 3384398. https://doi.org/10.1109/ACCESS.2024.3384398.

The authors declare that there are no conflicts of interest present.