NEURAL NETWORK ARCHITECTURES FOR PREVENTING AND DETECTING VARIOUS TYPES OF CYBER ATTACKS ON NETWORK RESOURCES DURING MARTIAL LAW

Abstract

This paper substantiates a comprehensive approach to developing intelligent intrusion detection and prevention systems (IDS/IPS) based on deep neural networks to protect critical infrastructure facilities under martial law conditions. It is proven that the physical degradation of telecommunications and communication instability during combat operations generate anomalous background network traffic, which negates the effectiveness of traditional signature-based methods. Particular attention is paid to solving the fundamental problem of extreme data imbalance: massive attacks mask minority but critically dangerous threats (such as U2R privilege escalation and R2L remote access) characteristic of targeted multi-stage operations by Advanced Persistent Threats (APTs).

To select the optimal mathematical models, an experimental verification of unsupervised algorithms (Kohonen Self-Organizing Maps, SOM), base networks (MLP, CNN), and ensemble hybrid architectures (CNN+MLP, Hopfield+Transformer) was conducted. The performance evaluation was carried out on three datasets of different generations and complexity: the classic KDD99, NSL-KDD, and the modern UNSW-NB15 dataset, which served as an extreme stress test. During the simulation, weighted class balancing mechanisms and procedures for adaptive scaling of the computational capacity of neural networks were successfully implemented.

Experimental results confirm that unsupervised and base models tend to ignore minority classes, demonstrating a critically low detection completeness (Recall) for them. In contrast, hybrid solutions provide a high capability for spatiotemporal generalization. The CNN+MLP architecture showed the best balance in detecting all attack classes, while the Hopfield+Transformer model proved its robustness in recognizing obfuscated patterns. The prospects of implementing multimodal ensembles for the reliable detection of evolving cyber threats in a highly noisy network environment are substantiated.