INTELLIGENCE ALGORITHMS FOR INTRUSION AND ANOMALY DETECTION IN VIRTUAL CLOUD NETWORKS, SOFTWARE AND EXPERIMENT DESIGN

摘要

The work describes the experience of development and application of a distributed threat detection system in a virtual cloud infrastructure. It presents the architecture of the complex, and the concept of its operation in the operator-controlled mode of experimental data collection and in the autonomous mode of identifying threats and deviant behavior in a virtual local network. It presents diagrams of the interaction of subsystems in BPMN 2 notation that was chosen for the tasks of business processes simulation due to the extensive support of expressive means designed to reflect event-driven asynchronous processes. A significant role in building a comprehensive picture of the complex operation is played by the correct understanding of the order in which events are processed by the complex components and the principles of prioritizing responses. A number of "abstract" subsystems are distinguished in the structure (hereinafter, the abstract subsystem is understood as a subsystem that is not represented by a particular flow of execution and arises as a result of the interaction of the complex components).