EXPERT SYSTEM FOR INFORMATION SECURITY EVENT ANALYSIS
This article explores the development of a hybrid expert system for analyzing information security events, aimed at automating threat detection in network traffic. Given the growing volume of data and the complexity of attacks, traditional analysis methods are ineffective, necessitating the integration of machine learning and expert rules. The goal of the study is to create a modular system architecture comprising four components: data collection (Apache Kafka), preprocessing (Apache Flink), analysis and classification (Random Forest with rule-based postprocessing), and logging (Elastic Stack). A Python prototype was tested on the UNSW-NB15 dataset, demonstrating a binary classification accuracy of 0,890 and a multiclass classification accuracy of 0,781. The hybrid approach increases recall for selected attack classes (Analysis, Backdoor, DoS) by 19–100% while reducing overall accuracy by 1,2%, ensuring the interpretability of solutions. The conclusion suggests future directions, including rule optimization through reinforcement learning, integration of LSTM artificial neural networks, and automatic knowledge base updating.
Potienko D.A., Gazizov A.R., Legonko O.L. Expert System for Information Security Event Analysis // Research result. Information technologies. – Т.11, №1, 2026. – P. 40-53. DOI: 10.18413/2518-1092-2026-11-1-0-5
While nobody left any comments to this publication.
You can be first.