Synergistic Effect of Multi-Label Dependencies in Classifying Computer Attacks

The article investigates the impact of multi-label dependencies on the accuracy of computer attack classification in the context of information security. The primary focus is on the problem of multi-label target attributes in datasets, which arise during simultaneous attacks on computer network nodes. The authors propose a computer network model that accounts for multi-label dependencies using the Binary Relevance method and a software-hardware complex for data collection and preprocessing. To evaluate attribute informativeness and synergistic effects, correlation matrix and entropy analyses were conducted, revealing differences in the distribution of information significance among target labels. The experimental study compares the performance of the Random Forest ensemble algorithm in single-label and multi-label implementations. Results demonstrate that accounting for multi-label dependencies improves classification accuracy for denial-of-service attacks (by 6 %) and network reconnaissance attacks (by 13%), but reduces accuracy for normal computer network operation and fuzzing attacks. The identified synergistic effect underscores the necessity of incorporating multi-label dependencies when designing systems to detect complex and combined attacks.