|
| Име: |
ВИКТОРИЯ ИВОВА ИВАНОВА |
| Месторабота: |
Технически университет - Габрово |
| Длъжност (звание): |
Асистент, висше училище |
| Катедра: |
Компютьрни системи и технологии |
| Кабинет(и): |
3408 А |
| Служебен тел.: |
(066 827)+411 |
| E-mail1: |
|
|
| Съдържание:
Публикации (2)
|
| Публикация: №1 | Ivanova, V.; Genkov, D. A Machine Learning-Based Network Anomaly Detection System Prototype Using Isolation Forest. Eng. Proc. 2026, 154, 7. https://doi.org/10.3390/engproc2026154007 | | Издателство: | MDPI Engineering Proceedings, Proceedings of The International Conference on Electronics, Engineering Physics and Earth Science (EEPES2026) | | Изд.год.: | 2026 | | Вид: | Научна публикация - Статия в чужд. списание | | Абстракт: | Due to the large amount of network traffic, manual network security management has become increasingly difficult. This paper proposes an open-source network anomaly detection system prototype that operates with the Security Onion 2.4 platform. The system relies on a custom Python engine that uses the machine learning (ML) algorithm Isolation Forest to detect anomalies in multiple Zeek datasets. The prototype was developed as a virtual machine (VM), which is hosted on a server running the software for virtualization VMware ESXi 6.0.0. For the experimental tests, live network telemetry from a university network was used. The results show that the system achieves a constant anomaly detection rate of 5.4% after a volumetric threshold of 5000 logs is reached within operating periods ranging from fifteen to thirty minutes. During testing, it was discovered that the detection logic has a minimal resource impact (less than 1 GB) on the running system beyond the defined baseline of average Random Access Memory (RAM) usage. This proposed solution is an open-source and zero-cost alternative to other paid network security solutions, demonstrating that abnormal behavior detection in network traffic can be effectively integrated on existing computer configurations without the need for expensive licenses. | | Web: | https://www.mdpi.com/2673-4591/154/1/7 | | Пълен текст: | Изтегли | |
| Публикация: №2 | Ivanova, V., STUDY OF EXISTING SOLUTIONS FOR NETWORK TRAFFIC ANALYSIS, UNITECH – SELECTED PAPERS - 2025, International Scientific Conference “UNITECH 2025” – Gabrovo, 20-22 November, 2025, pp. 247-252, Print ISSN: 1313-230X, Online ISSN: 3033-1404 | | Издателство: | International Scientific Conference “UNITECH 2025” – Gabrovo | | Изд.год.: | 2025 | | Вид: | Научна публикация - Доклад от межд. конф. в Б-я | | Абстракт: | Network traffic analysis (NTA) is a foundational process critical for ensuring cybersecurity, optimizing performance and enabling efficient troubleshooting across modern hybrid and cloud infrastructures. The shift towards distributed architecture makes comprehensive network visibility a paramount concern, as traffic remains the sole undeniable source of truth regarding network operations. This report conducts an in-depth study of the three primary NTA solutions based on their network analysis methodologies: deep packet inspection (DPI) tools, flow-based analyzers and modern AI-driven network detection and response (NDR) systems. The evaluation of the NTA solutions is uniquely structured around four industry-recognized criteria: forensic depth, scalability, Zero-Day detection efficiency and total cost of ownership (TCO). The study indicates that there isn’t a single solution that is universally effective, as each excels in a specific situation. The report concludes that an optimal strategy for contemporary security operations requires a synergistic, complex approach combining all three existing solutions. The originality of the study lies in bridging technical evaluation with strategic integration, guiding adoption of hybrid NTA solutions. | | Web: | https://www.doi.org/10.70456/FYRT9644 | | Пълен текст: | Изтегли | |
|