kaz29Вестник Казахстанско-Британского технического университетаHerald of the Kazakh-British Technical University1998-66882959-8109Казахстанско-Британский Технический Университет10.55452/1998-6688-2025-22-4-79-96kaz29-2282Research ArticleКОМПЬЮТЕРНЫЕ НАУКИCOMPUTER SCIENCEСРАВНИТЕЛЬНОЕ ИССЛЕДОВАНИЕ МЕТОДОВ МАШИННОГО ОБУЧЕНИЯ ДЛЯ ВЫЯВЛЕНИЯ АНОМАЛИЙ В СЕТЕВОМ ТРАФИКЕCOMPARATIVE STUDY OF MACHINE LEARNING METHODS FOR DETECTING ANOMALIES IN NETWORK TRAFFIChttps://orcid.org/0009-0000-0145-5718КикбаевН. Е.KikbayevN. E.

магистрант

г. Алматы

Master’s student

Almaty

kikbaevnurbek@gmail.comhttps://orcid.org/0009-0008-1884-4662ЖексебайД. М.ZhexebayD. M.

PhD

г. Алматы

PhD

Almaty

zhexebay92@gmail.comhttps://orcid.org/0000-0001-6169-0795СиньЮ.XinY.

профессор

г. Сиань

Professor

Xi’an

qyuxiao@purdue.eduhttps://orcid.org/0000-0002-9326-9476ТынымбаевС. Т.TynymbayevS. T.

профессор

г. Алматы

Professor

Almaty

s.tynym@gmail.comАйтмагамбетовА. З.AitmagambetovA. Z.

профессор

г. Алматы

Professor

Almaty

a.aitmagambetov@iitu.edu.kzhttps://orcid.org/0009-0000-5965-7195АбдижалиловаЛ. Б.AbdizhalilovaL. B.

магистрант

г. Алматы

Master’s student

Almaty

abdijalil.lazzat@bk.ruhttps://orcid.org/0000-0002-5196-8252СқабыловА. А.SkabylovA. A.

PhD

г. Алматы

PhD

Almaty

Alisher.skabylov@kaznu.edu.kzКазахский национальный университет им. аль-ФарабиКазахстанAl-Farabi Kazakh National UniversityKazakhstanСеверо-Западный политехнический университетКитайNorthwestern Polytechnical UniversityChinaМеждународный университет информационных технологийКазахстанInternational Information Technology UniversityKazakhstan2025231220252247996Copyright © Кикбаев Н.Е., Жексебай Д.М., Синь Ю., Тынымбаев С.Т., Айтмагамбетов А.З., Абдижалилова Л.Б., Сқабылов А.А., 20252025Кикбаев Н.Е., Жексебай Д.М., Синь Ю., Тынымбаев С.Т., Айтмагамбетов А.З., Абдижалилова Л.Б., Сқабылов А.А.Kikbayev N.E., Zhexebay D.M., Xin Y., Tynymbayev S.T., Aitmagambetov A.Z., Abdizhalilova L.B., Skabylov A.A.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.kbtu.edu.kz/jour/article/view/2282

Спрос на системы обнаружения вторжений (IDS), которые могут оперативно определять как известные, так и новые типы атак, растет из-за быстрого расширения киберугроз и последующего увеличения сетевого трафика. Использование методов машинного обучения для автономного анализа поведения сетевых пакетов и классификации их как нормальных или вредоносных является многообещающим способом решения этой проблемы. Целью данного исследования является оценка пригодности различных алгоритмов машинного обучения для решения проблем сетевой безопасности путем использования анализа сетевых данных в качестве иллюстрации. В данном исследовании оценивается эффективность моделей машинного обучения при обнаружении сетевых вторжений с использованием набора данных UNSW-NB15. Основная цель этого исследования – оценить эффективность различных моделей машинного обучения, включая случайный лес, метод K-ближайших соседей (KNN), опорную векторную машину (SVM), XGBoost, LightGBM и логистическую регрессию, в приложениях сетевой безопасности. Согласно анализу, все модели продемонстрировали высокую точность классификации; однако модель LightGBM достигла самых значительных результатов. Эта модель продемонстрировала самые высокие значения точности (95,86%), точности (96,02%) и F1-меры (96,99%), что подтверждает ее способность эффективно управлять сложными и неоднородными данными. В целом исследование подчеркивает важность выбора наиболее подходящей модели на основе целей системы безопасности и специфики данных.

The demand for intrusion detection systems (IDSs) that can promptly identify both known and new types of attacks is on the rise due to the rapid expansion of cyber threats and the consequent increase in network traffic. The utilization of machine learning techniques to autonomously analyze the behavior of network packets and classify them as normal or malicious is a promising way to address this issue. The objective of this investigation is to assess the suitability of a variety of machine learning algorithms for the resolution of network security issues by employing network data analysis as an illustration. This investigation assesses the efficacy of machine learning models in detecting network intrusions using the UNSW-NB15 dataset. This study’s primary objective is to assess the effectiveness of various machine learning models, including Random Forest, K-Nearest Neighbors (KNN), Support Vector Machine (SVM), XGBoost, LightGBM, and Logistic Regression, in network security applications. According to the analysis, all models exhibited high classification accuracy; however, the LightGBM model attained the most remarkable results. This model exhibited the highest values of Accuracy (95.86%), Precision (96.02%), and F1-measure (96.99%), confirming its capacity to effectively manage complex and heterogeneous data. Overall, the study underscores the significance of selecting the most appropriate model based on the security system’s objectives and the specifics of the data.

машинное обучениесетевой трафикLightGBMкибербезопасностьIDSанализ данныхmachine learningnetwork trafficLightGBMcybersecurityIDSdata analysisReferencesZhexebay, D., Skabylov, A., Ibraimov, M., Khokhlov, S., Agishev, A., Kudaibergenova, G., Orazakova, A., & Agishev, A. Deep Learning for Early Earthquake Detection: Application of Convolutional Neural Networks for P-Wave Detection. Applied Sciences, 15(7), 3864 (2025). https://doi.org/10.3390/app15073864.Zhexebay, D., Skabylov, A., Ibraimov, M., Khokhlov, S., Agishev, A., Kudaibergenova, G., Orazakova, A., & Agishev, A. Deep Learning for Early Earthquake Detection: Application of Convolutional Neural Networks for P-Wave Detection. Applied Sciences, 15(7), 3864 (2025). https://doi.org/10.3390/app15073864.Moulaei, K., Shanbehzadeh, M., Mohammadi-Taghiabad, Z., Mousavi, S. F., & Jafari, S. Comparing machine learning algorithms for predicting COVID-19 mortality. BMC Medical Informatics and Decision Making, 22(1), 2 (2022). https://doi.org/10.1186/s12911-021-01742-0.Moulaei, K., Shanbehzadeh, M., Mohammadi-Taghiabad, Z., Mousavi, S. F., & Jafari, S. Comparing machine learning algorithms for predicting COVID-19 mortality. BMC Medical Informatics and Decision Making, 22(1), 2 (2022). https://doi.org/10.1186/s12911-021-01742-0.Seydi, S. T., Kanani-Sadat, Y., Hasanlou, M., Sahraei, R., Chanussot, J., & Amani, M. Comparison of Machine Learning Algorithms for Flood Susceptibility Mapping. Remote Sensing, 15(1), 192 (2023). https://doi.org/10.3390/rs15010192.Seydi, S. T., Kanani-Sadat, Y., Hasanlou, M., Sahraei, R., Chanussot, J., & Amani, M. Comparison of Machine Learning Algorithms for Flood Susceptibility Mapping. Remote Sensing, 15(1), 192 (2023). https://doi.org/10.3390/rs15010192.Zhao, Z., Islam, F., Waseem, L. A., Tariq, A., Nawaz, M., Islam, I. U., Bibi, T., Rehman, N. U., Ahmad, W., Aslam, R. W., Raza, D., & Hatamleh, W. A. Comparison of three machine learning algorithms using Google Earth Engine for Land Use Land Cover classification. Rangeland Ecology & Management, 92, 129– 137 (2024). https://doi.org/10.1016/j.rama.2023.10.007.Zhao, Z., Islam, F., Waseem, L. A., Tariq, A., Nawaz, M., Islam, I. U., Bibi, T., Rehman, N. U., Ahmad, W., Aslam, R. W., Raza, D., & Hatamleh, W. A. Comparison of three machine learning algorithms using Google Earth Engine for Land Use Land Cover classification. Rangeland Ecology & Management, 92, 129– 137 (2024). https://doi.org/10.1016/j.rama.2023.10.007.Ijaz, M., Durad, M. H., & Ismail, M. Static and dynamic malware analysis using machine learning. In 2019 16th International Bhurban Conference on Applied Sciences and Technology (IBCAST) (pp. 687–691). IEEE (2019). https://doi.org/10.1109/IBCAST.2019.8667136.Ijaz, M., Durad, M. H., & Ismail, M. Static and dynamic malware analysis using machine learning. In 2019 16th International Bhurban Conference on Applied Sciences and Technology (IBCAST) (pp. 687–691). IEEE (2019). https://doi.org/10.1109/IBCAST.2019.8667136.Akhtar, M. S., & Feng, T. Malware Analysis and Detection Using Machine Learning Algorithms. Symmetry, 14(11), 2304 (2022). https://doi.org/10.3390/sym14112304.Akhtar, M. S., & Feng, T. Malware Analysis and Detection Using Machine Learning Algorithms. Symmetry, 14(11), 2304 (2022). https://doi.org/10.3390/sym14112304.Baker del Aguila, R., Contreras Pérez, C. D., Silva-Trujillo, A. G., Cuevas-Tello, J. C., & NunezVarela, J. Static Malware Analysis Using Low-Parameter Machine Learning Models. Computers, 13(3), 59 (2024). https://doi.org/10.3390/computers13030059.Baker del Aguila, R., Contreras Pérez, C. D., Silva-Trujillo, A. G., Cuevas-Tello, J. C., & NunezVarela, J. Static Malware Analysis Using Low-Parameter Machine Learning Models. Computers, 13(3), 59 (2024). https://doi.org/10.3390/computers13030059.Zhang, C., Jia, D., Wang, L., Wang, W., Liu, F., & Yang, A. Comparative research on network intrusion detection methods based on machine learning. Computers & Security, 121, 102861 (2022). https://doi.org/10.1016/j.cose.2022.102861.Zhang, C., Jia, D., Wang, L., Wang, W., Liu, F., & Yang, A. Comparative research on network intrusion detection methods based on machine learning. Computers & Security, 121, 102861 (2022). https://doi.org/10.1016/j.cose.2022.102861.Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150 (2021). https://doi.org/10.1002/ett.4150.Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150 (2021). https://doi.org/10.1002/ett.4150.Asif, M., Abbas, S., Khan, M. A., Fatima, A., Khan, M. A., & Lee, S.-W. MapReduce based intelligent model for intrusion detection using machine learning technique. Journal of King Saud University – Computer and Information Sciences, 34(10, Part B), 9723–9731 (2022). https://doi.org/10.1016/j.jksuci.2021.12.008.Asif, M., Abbas, S., Khan, M. A., Fatima, A., Khan, M. A., & Lee, S.-W. MapReduce based intelligent model for intrusion detection using machine learning technique. Journal of King Saud University – Computer and Information Sciences, 34(10, Part B), 9723–9731 (2022). https://doi.org/10.1016/j.jksuci.2021.12.008.Musleh, D., Alotaibi, M., Alhaidari, F., Rahman, A., & Mohammad, R.M. Intrusion detection system using feature extraction with machine learning algorithms in IoT. Journal of Sensor and Actuator Networks, 12(2), 29 (2023). https://doi.org/10.3390/jsan12020029.Musleh, D., Alotaibi, M., Alhaidari, F., Rahman, A., & Mohammad, R.M. Intrusion detection system using feature extraction with machine learning algorithms in IoT. Journal of Sensor and Actuator Networks, 12(2), 29 (2023). https://doi.org/10.3390/jsan12020029.Attou, H., Guezzaz, A., Benkirane, S., Azrour, M., & Farhaoui, Y. Cloud-based intrusion detection approach using machine learning techniques. Big Data Mining and Analytics, 6(3), 311–320 (2023). https://doi.org/10.26599/BDMA.2022.9020038.Attou, H., Guezzaz, A., Benkirane, S., Azrour, M., & Farhaoui, Y. Cloud-based intrusion detection approach using machine learning techniques. Big Data Mining and Analytics, 6(3), 311–320 (2023). https://doi.org/10.26599/BDMA.2022.9020038.Saheed, Y.K., Abiodun, A.I., Misra, S., Holone, M.K., & Colomo-Palacios, R. A machine learningbased intrusion detection for detecting Internet of Things network attacks. Alexandria Engineering Journal, 61(12), 9395–9409 (2022). https://doi.org/10.1016/j.aej.2022.02.063.Saheed, Y.K., Abiodun, A.I., Misra, S., Holone, M.K., & Colomo-Palacios, R. A machine learningbased intrusion detection for detecting Internet of Things network attacks. Alexandria Engineering Journal, 61(12), 9395–9409 (2022). https://doi.org/10.1016/j.aej.2022.02.063.Moustafa, N., & Slay, J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). 2015 Military Communications and Information Systems Conference (MilCIS), 1–6 (2015). https://doi.org/10.1109/MilCIS.2015.7348942.Moustafa, N., & Slay, J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). 2015 Military Communications and Information Systems Conference (MilCIS), 1–6 (2015). https://doi.org/10.1109/MilCIS.2015.7348942.Turukmane, A.V., & Devendiran, R. M-MultiSVM: An efficient feature selection assisted network intrusion detection system using machine learning. Computers & Security, 137, 103587 (2024). https://doi.org/10.1016/j.cose.2023.103587.Turukmane, A.V., & Devendiran, R. M-MultiSVM: An efficient feature selection assisted network intrusion detection system using machine learning. Computers & Security, 137, 103587 (2024). https://doi.org/10.1016/j.cose.2023.103587.Ajagbe, S.A., & Alabi, O.O. Comparative Study of Machine Learning Models Using UNSW Datasets. In The 45th Annual Conference of the South African Institute of Computer Scientists and Information Technologists (p. 69). URL: https://saicsit2024.mandela.ac.za/saicsit2024/media/Store/documents/SAICSIT_PGS_v1-3.pdf#page=72.Ajagbe, S.A., & Alabi, O.O. Comparative Study of Machine Learning Models Using UNSW Datasets. In The 45th Annual Conference of the South African Institute of Computer Scientists and Information Technologists (p. 69). URL: https://saicsit2024.mandela.ac.za/saicsit2024/media/Store/documents/SAICSIT_PGS_v1-3.pdf#page=72.Hussain, A., Khatoon, A., Aslam, A., & Khosa, M. A comparative performance analysis of machine learning models for intrusion detection classification. Journal of Cybersecurity, 6,1 (2024). https://www.proquest.com/openview/08a4c605b57abbca71467cce40765b15/1?pq-origsite=gscholar&cbl=4585457.Hussain, A., Khatoon, A., Aslam, A., & Khosa, M. A comparative performance analysis of machine learning models for intrusion detection classification. Journal of Cybersecurity, 6,1 (2024). https://www.proquest.com/openview/08a4c605b57abbca71467cce40765b15/1?pq-origsite=gscholar&cbl=4585457.Mishra, N., & Mishra, S. A Review of Machine Learning-based Intrusion Detection System. EAI Endorsed Transactions on Internet of Things, 10 (2024). https://doi.org/10.4108/eetiot.5332.Mishra, N., & Mishra, S. A Review of Machine Learning-based Intrusion Detection System. EAI Endorsed Transactions on Internet of Things, 10 (2024). https://doi.org/10.4108/eetiot.5332.Tahri, R., Benslimane, Y., Rifi, M., & Maqnaoui, M. Intrusion detection system using machine learning algorithms. ITM Web of Conferences, 46, 02003 (2022). https://doi.org/10.1051/itmconf/20224602003.Tahri, R., Benslimane, Y., Rifi, M., & Maqnaoui, M. Intrusion detection system using machine learning algorithms. ITM Web of Conferences, 46, 02003 (2022). https://doi.org/10.1051/itmconf/20224602003.Saranya, T., Sridevi, S., Deisy, C., Chung, T. D., & Ahamed Khan, M.K. Performance analysis of machine learning algorithms in intrusion detection system: A review. Procedia Computer Science, 171, 1251–1260 (2020). https://doi.org/10.1016/j.procs.2020.04.133.Saranya, T., Sridevi, S., Deisy, C., Chung, T. D., & Ahamed Khan, M.K. Performance analysis of machine learning algorithms in intrusion detection system: A review. Procedia Computer Science, 171, 1251–1260 (2020). https://doi.org/10.1016/j.procs.2020.04.133.

The authors declare that there are no conflicts of interest present.