A GENERALIZED MODEL FOR PREDICTING AND DETECTING CYBERSECURITY ANOMALIES BASED ON ARTIFICIAL INTELLIGENCE

Abstract

The article presents the development of an integrated mathematical model for forecasting network load and detecting cybersecurity anomalies, based on modern deep learning methods and the autoencoder architecture. The proposed approach combines neural network-based forecasting functionality with automated mechanisms for identifying deviations in network traffic behavior. At the initial stage, the model performs preprocessing of historical data using normalization and exponential smoothing, which allows for the effective extraction of current load patterns. Forecasting is carried out using a deep neural network optimized by gradient descent to minimize the mean squared error (MSE). An autoencoder is applied for anomaly detection, trained on normal data and employing the Euclidean norm of the difference between input and reconstructed signals to quantify the anomaly level. Anomaly boundaries are adaptively generated based on standard deviation and a sensitivity parameter, enhancing detection accuracy under dynamic network conditions. Additionally, the study introduces a model for assessing the criticality of network states by considering the proportion of anomalous values within the overall data stream. This allows for event classification by threat level and ensures timely system response. The integrated model operates as a multi-level self-learning system capable of not only forecasting the future network state but also detecting potentially dangerous conditions in real time. Practical implementation of the proposed approach achieves high forecasting accuracy (up to 95%) even in the presence of anomalies and significantly reduces false alarms. The relevance of this research is supported by current challenges related to digitalization, network scalability, and the growing need for security amid increasing complexity of IT infrastructures. The presented model is an effective tool for monitoring, analysis, and threat response in the context of NFV/SDN technologies, IoT, and cloud computing.