Detection of anomalies in local traffic using secure gating networks

Abstract

Purpose. To develop and evaluate a method for detecting anomalies in local network traffic based on the FCRNN-GRU architecture in order to improve classification accuracy and reduce the rate of false positive alerts. Methodology. In the study, network interactions are represented as normalized time series, which makes it possible to capture the dynamics of traffic changes. The baseline model is a fully connected recurrent neural network capable of identifying complex nonlinear and long-term dependencies due to its densely connected recurrent structure. To improve training efficiency and avoid the vanishing gradient problem, mini-batch stochastic gradient descent is used. The additional integration of GRU (Gated Recurrent Unit) enables optimization of the trade-off between model accuracy and computational complexity. Experimental evaluation was conducted on a dataset of 52,000 network flows, including 32,000 normal traffic instances and 20,000 anomalous ones covering various types of cyber threats. The network environment was simulated on a Linux platform using Mininet and Wireshark, while algorithm implementation was carried out in Python. Findings. The FCRNN-GRU model demonstrates high performance: detection rate – 98.59 %, false alarm rate – 5.29 %, and classification accuracy – 99.21 %. Compared to traditional and clustering-based methods, the proposed approach provides a significant improvement and confirms its effectiveness. Originality. The scientific novelty of the study lies in the adaptation of a fully connected recurrent neural network with the integration of gated recurrent units for network traffic analysis tasks. The combination of dense recurrent connections with GRU mechanisms enables more accurate modeling of temporal patterns in traffic behavior, while simultaneously reducing computational costs and improving model efficiency when processing large volumes of data. Practical value. The proposed approach has practical significance and can be integrated into modern monitoring and cybersecurity systems. Its application contributes to the timely detection of anomalous events in the network, enhances the level of information infrastructure security, and reduces risks associated with cyber threats.