Hybrid method for detecting cyber threats in the network traffic

Modern cyber threats are characterized by a high degree of adaptability, secrecy and variability. This fact makes the task of their timely detection in network traffic one of the key problems in the field of cyber security of informatization objects. Traditional methods based on signatures and rigidly defined rules do not provide sufficient flexibility to detect previously unknown or modified attacks. Consequently, the relevance of developing new hybrid intelligent systems capable of taking into account the behavioral characteristics of traffic and adapt to its dynamics is increasing. The paper proposes a hybrid method for detecting cyber threats that combines the advantages of ensemble clustering and Bayesian probabilistic modeling. In the first stage, a machine learning model extracts the hidden behavioral features of network connections using multiple clustering algorithms. And the obtained behavioral embeddings are further used as input variables to construct a Bayesian network that models the probabilistic dependencies between behavioral attributes and anomaly attributes. The outlined approach will allow not only to detect abnormalities in traffic, but also to ensure the interpretability of the adopted security decisions. The practical significance of the proposed method lies in the potential of its integration into traffic monitoring systems in corporate and distributed network infrastructures.