AN ANALYSIS OF METHODS FOR IDENTIFYING COMPUTER ATTACKS
Purpose of the paper: studying the existing intrusion detection methods from the perspective of their advantages and drawbacks, as well as considering their classification. Methods of study: comparative analysis, statistical analysis, signature-based analysis, graph theory, Bayesian method. Results obtained: intrusion detection methods can be loosely divided into four groups: behavioural methods (suitable for searching anomalies), knowledge-based methods (suitable for searching abuses), and data mining methods (suitable for both search directions), the latter splitting into machine learning methods and computational intelligence methods. A promising group of such methods are hybrid methods combining elements of different ‘pure’ methods, and based on a comparison of the most significant weaknesses of analysed methods, a hybrid method using the strengths of artificial neural networks as well as of signature-based methods is put forth.