METHOD FOR DETECTING ANOMALIES IN CORPORATE NETWORKS

Abstract

The relevance of this study lies in the fact that existing anomaly detection methods often demonstrate insufficient accuracy and responsiveness in real-world operational environments. The object of research: the network traffic of a corporate information system, which is analyzed to detect abnormal behavior potentially indicating cyberattacks, security policy violations, or internal threats. Purpose of the article: the development, implementation, and experimental validation of an anomaly detection method for corporate networks based on an autoencoder model, which makes it possible to effectively identify deviations from normal network traffic without the need for pre-labeled data. Research results. In the modeling process, synthetic data simulating both typical and anomalous network activity was generated. Histograms and boxplots indicate that normal samples are characterized by low and stable mean squared error values, while anomalous samples demonstrate significant deviations. The ROC curve with AUC = 1.00 confirms that the model can reliably distinguish between the two categories. The confusion matrix showed a nearly perfect match between predicted and actual labels, indicating high accuracy and sensitivity of the model. The training curve demonstrates stable learning without overfitting, and the selected dynamic threshold minimized the false positive rate. The proposed approach can be integrated into security monitoring systems to detect atypical activities in real time. Conclusions. The conducted experiments demonstrated high classification accuracy, clear separation between normal and anomalous samples based on reconstruction error, and stable model training. The obtained results confirm the feasibility of using deep learning for automated network security monitoring, and the proposed method can be successfully applied in real corporate IT infrastructures to detect security incidents in real time.