HYBRID APPROACH TO ANOMALY DETECTION IN TELECOMMUNICATION IOT NETWORKS USING LIGHTWEIGHT ML MODELS

LIGHTWEIGHT ML MODELSThe article proposes a hybrid approach for effective detection and prevention of DDoS attacks, which, in the context of the rapidly growing number of IoT devices, enables anomaly detection without placing significant load on the devices and the network as a whole.The core of the approach is the development of an anomaly detection algorithm that allows a comprehensive evaluation and analysis of network traffic, using lightweight ML modules to ensure timely attack detection.The proposed approach uses a multi-layer model of the management system, which includes the access level, Edge analysis on AWS Greengrass servers, SDN, and cloud artificial intelligence, and allows traffic analysis to be performed closer to the source, minimizing delays and load on central servers.At the Edge level, the first stage of analysis is performed using lightweight machine learning methods, such as entropy analysis, heuristic analysis of SYN requests, and traffic classification using the Isolation Forest model.These methods effectively identify potential DDoS attacks, relying on statistical indicators such as traffic concentration, SYN request frequency, and changes in overall traffic volume.If at least one of the conditions is met -either a low entropy value from a single IP address, a high number of SYN requests, or spikes in them -the algorithm sends a notification to block the IP at the management level.An important stage is the integration with the SDN control level, where algorithms are used for real-time traffic management based on the obtained analysis results.The SDN controller can implement policies to block or limit traffic from the given IP address, allowing an immediate response to detected threats.The system automatically generates an alarm signal and applies protection policies when two out of three methods detect an anomaly.This significantly reduces response time to threats and ensures effective real-time protection.Additionally, at the cloud level, using Federated Learning and Reinforcement Learning technologies, the optimization of management policies and adaptation of the system to new types of attacks is carried out.