HYBRID MODEL OF NETWORK ANOMALIES DETECTION USING MACHINE LEARNING

The increasing complexity of cyber threats requires the development of effective methods for detecting and classifying attacks in network traffic. This study analyzes the effectiveness of three popular machine learning algorithms: Random Forest, which is used for anomaly detection, Support Vector Machines (SVM), which performs cyber threat classification, and autoencoders, which are used for data preprocessing and deep traffic analysis. Considering each method's advantages, a combined model is proposed that combines the capabilities of these algorithms, increasing the efficiency of threat detection and optimizing the attack classification process. The experiments demonstrate that the proposed approach increases attack detection accuracy by 3–7% and reduces response time compared to using individual machine learning algorithms. In addition, the combined model contributes to resource optimization, which is a critical factor for deploying scalable solutions in real-world conditions. Special attention is paid to the hybrid model that combines autoencoders and the Random Forest algorithm. Its effectiveness has been confirmed in test environments, where better results in detecting network anomalies were demonstrated compared to the use of only one algorithm. The proposed approach allows not only to increase the level of protection of information systems, but also to provide flexibility in configuration, which makes the model suitable for use in a wide range of cybersecurity tasks. The results obtained can be used to improve existing cyber protection methods, in particular in the field of critical infrastructure protection, where timely detection of threats is a key security factor. The high efficiency of the combined approach confirms its feasibility for implementation in network traffic monitoring systems and cybersecurity in general.