Application of Machine Learning Methods in Building a Multimodal Model for Detecting and Classifying Attacks in Network Traffic of the ACS

Detecting anomalies in network traffic is an important aspect of information security when building intrusion detection systems. In this case, it is often necessary to process mixed data containing text and numerical information. Therefore, it is relevant to develop multimodal models that can analyze mixed data. This paper analyzes the machine learning models used for anomaly detection, the main aspects of their training and the specifics of dividing data into training and validation samples. The approach of anomaly detection in network traffic is proposed for detection of TCP flooding and port scanning attacks using data obtained with Wireshark utility. Experimental results are presented to validate the multimodal model used to detect anomalies in network traffic, as well as the results of evaluating the effectiveness of anomaly detection using quality metrics.