This paper focuses on the problems of ensuring cybersecurity of civil aviation information and communication systems, that are critical for flight safety and the functioning of the industry overall. With the growth of information flows, the complexity of communication systems, and the increasing frequency of cyber threats, it is imperative to develop effective methods for detecting and neutralizing attacks. The paper highlights the current cybersecurity challenges in the aviation sector, including DoS, DDoS, XSS, CSRF, and ransomware attacks. The paper analyses threat detection methods, including signature-based, anomaly analysis, machine learning, and combined approaches. The architecture of the module for detecting and analyzing cyber threats using combined machine learning models, such as Random Forest, MLP, and SVM, is provided. This allows the system to increase its accuracy and sensitivity, reduce the number of false positives, and ensure adaptability to new threats. In particular, the results of the study showed an increase in attack detection accuracy by 1.05-1.48 times, sensitivity by 1.02 times, and predictive ability by 2.18 times. The module is based on an integrated approach that includes real-time data collection, pre-processing, analysis based on machine learning algorithms, and automatic threat response. The proposed system demonstrates high efficiency in real-time conditions, protecting the surface-to-air and air-to-air channels. It can be adapted for other critical industries. Thus, the proposed solution is a promising tool for ensuring cybersecurity in civil aviation and critical infrastructure in general.
Civil aviation is one of the most important critical infrastructures that not only transports
passengers and cargo but also supports global economic and social processes [
The modern development of information technology and the growth of cyber threats make the security of information and communication systems at civil aviation facilities a critical task. The aviation industry is one of the most attractive targets for cyberattacks, as it is integrated into the global infrastructure and has a huge impact on passenger safety and the functioning of the economy. Attacks targeting aviation communication channels can have significant consequences, including disruption of flight control systems, loss of confidential data, or even disruption of airport operations.
Over the past few years, cyberattacks on the aviation industry have been increasing in both frequency and sophistication. In particular, from 2022 to 2024, the number of attacks on critical infrastructure, including aviation, increased significantly. In 2023, attacks using the MOVEit ransomware became widely known, causing data breaches at airlines such as British Airways and Aer Lingus. The vulnerability allowed the attackers to gain access to employees’ data, including payment and other confidential information. In the period from 2022 to 2023, there were also numerous attempts to compromise aviation systems using botnets, which makes it difficult to identify the source of attacks and can lead to significant operational disruptions. Another problem is the growing number of DDoS attacks that disrupt airports and airlines. DDoS attacks on flight control systems lead to flight delays and financial losses namely, a cyberattack on Japan Airlines (December 26, 2024), and two Italia airports (December 28, 2024).
The authors’ analysis of cyber threats in civil aviation over the past five years shows a significant increase in attacks. Key trends: Ransomware: The number of attacks increased from 20% in 2019 to 40% in 2023.DDoS attacks: The share of attacks increased from 15% to 25%, indicating a growing interest of attackers in destabilizing aviation online services. Data threats: A significant increase from 25% to 45% was noted, highlighting the critical importance of protecting personal and corporate data. Malware: The number of incidents increased from 10% to 20%, indicating the active use of malware to compromise systems. Social engineering: Although its share is smaller, it is gradually increasing—from 5% to 15%, remaining a powerful tool for cybercriminals.
The chart shows the percentage distribution of major cyber threats in aviation over the last 5 years (Fig. 1). The data highlights the need to strengthen cybersecurity measures, including data protection, communication protocols, and flight management systems. It is also important to raise staff awareness and implement modern technologies to monitor and prevent attacks.
One of the most promising approaches to improving the security of aviation communication
channels is the use of machine learning to detect anomalous behavior in network traffic [
The purpose of this study is to design and evaluate the effectiveness of a combined machinelearning system for real-time threat detection in aviation communication channels. The paper shows how the combination of models can increase the accuracy of attack detection, improve the system’s sensitivity to new threats, and ensure classification stability under challenging network conditions. The test results confirm that the proposed solution is an effective tool for ensuring cybersecurity in the aviation sector. The designed software module combines the signature method with machine learning methods such as Random Forest, MLP, and SVM, ensuring increased efficiency of cyber threat detection. This model provides the ability to adapt to new types of attacks, improve detection accuracy, and reduce threat processing time. In a dynamic information and communication systems environment, this is crucial for ensuring the reliability and uninterrupted operation of systems. The module aims to improve detection accuracy using combined models. The results of the study showed an increase in accuracy, sensitivity, and a reduction in false positives, making this approach particularly effective in the context of civil aviation cybersecurity.
Various methods and approaches are used to effectively detect cyberattacks, each with its
characteristics, advantages, and disadvantages. Understanding these methods is key to building
robust cybersecurity systems that can detect and respond to threats promptly [
first infection is still unknown, and the database simply does not have enough signatures to search for it, so the system will not be able to signal danger, as it considers the attacking activity to be legitimate.
Anomaly-based detection—this method consists of finding and identifying elements, events, or observations that deviate from the expected behavior or other elements of the data set. In the context of detecting network abuse or intrusion, unexpected activity spikes are of primary interest, not just rare events. These spikes do not meet the common statistical definition of outliers as rare objects, so many outlier detection methods, especially unsupervised algorithms, are ineffective without appropriate data collection.
Machine learning and AI—this method is very effective nowadays because AI can analyze
huge amounts of data from various sources, identifying patterns of activity within an
organization. It can track the time and place of login, the volume of network traffic, as well
as the devices and cloud applications used. By understanding what actions are typical for
employees, AI can detect anomalies that may indicate potential threats and require further
investigation. To ensure confidentiality, data from one organization is not used to train AI
in other companies. Instead, AI uses synthesized global threat intelligence gathered from
many organizations to improve the efficiency of its analysis [
Combined—this method of cyber-attack detection includes different approaches to improve detection efficiency and reduce the number of false positives. This method takes advantage of several techniques, such as signature analysis, anomaly analysis, and machine learning, to create a more reliable and accurate threat detection system. From signature analysis, this method uses databases of known attack patterns or signatures to compare current activity with known attacks. With anomaly analysis, this method detects deviations from normal system or network behavior by creating a model of normal activity and tracking any anomalies. This helps to detect new, previously unknown attacks. With machine learning and AI, this method automatically detects anomalies and attacks by analyzing large amounts of data and identifying complex patterns.
Considering these aspects, it becomes clear that effective cyberattack detection requires a comprehensive approach that combines the advantages of several classes of solutions. Thus, to further improve cyberattack detection systems, it is proposed to develop a software solution that integrates the best practices from each of the analyzed classes. In particular, it is important to pay attention to the use of artificial intelligence to automate threat detection, which will increase the effectiveness of responding to new and complex attacks.
A combined method is the best choice for aviation communication channels that require maximum accuracy, adaptability, and speed, namely a combination of signature-based methods and machine learning algorithms. It allows the detection of both known and new threats, reducing risks to critical infrastructure (Table 1). Machine Automation, adaptation to learning and AI new threats
Disadvantages Failure to detect new attacks need for updates False positives need for adaptation Complexity and resource intensity
Detectable attacks DoS, SQLi, XSS DDoS, intrusion attempts Combined attacks, XSS + CSRF Combined
Maximum accuracy, reduction High complexity and costs of false alarms All the attacks mentioned
Modern cybersecurity systems are faced with an ever-increasing number of rapidly evolving threats. In particular, as the complexity and frequency of cyberattacks increase, existing defense methods are proving insufficiently effective. Traditional threat detection systems are largely based on static rules and signatures, making them vulnerable to new, unknown types of attacks [15].
Thus, there is an urgent need for new approaches that can adapt to changing conditions and provide more flexible and effective detection of cyberattacks.
Consider further the main machine learning algorithms that will be used in the developed system to detect cyber threats. These algorithms are responsible for analyzing data, identifying potential threats, and making decisions on further actions. Through the use of machine learning, the system can adapt to new challenges in the field of cybersecurity, improving its methods and approaches in real time [14, 16–19].
Random Forest is an ensemble machine learning method that consists of many decision trees that work together. Each tree in the random forest is generated from a random sample of data, and the result is determined by the voting of all the trees. This method is a powerful tool for classification and regression and is especially effective in situations where data has many features [16].
Formula for node splitting calculation (Gini(D)):
C Gini ( D )=1−∑ pi2 , i=1 (1) where Gini ( D ) is the measure of node D impurity; C is number of classes; pi is the probability of class i in the node .
Random Forest is an ensemble method that combines many individual decision trees to improve the accuracy and resilience of the model. This algorithm was chosen because of its ability to work efficiently with large amounts of data and many features, which is typical for cybersecurity tasks. Random Forest effectively processes data containing noise or missing values, which reduces the likelihood of false positives. In addition, this method is highly interpretable, making it easy to explain the model’s decisions and identify the key features that influenced the result.
SVM is an algorithm for data classification that finds the hyperplane that best separates classes in the feature space. Choosing a hyperplane that maximizes the distance (margin) between different classes helps SVM achieve high classification accuracy [20–22].
The formula for loss function (L):
L( w , b , xi , yi )=max ( 0 ,1− yi ( w × xi+b ) , (2) where w is weight vector; b is offset; xi is feature vector; yi is class label (+1 or –1).
The basis for this model is the concept of margin maximization, which is used to achieve optimal class separation in the feature space. The loss function L minimizes classification errors, ensuring optimal class separation.
Support Vector Machine is a powerful method for data classification, especially when it involves tasks with many features and a small number of training examples. SVM was chosen because of its ability to work effectively in high-dimensional feature space and provide good generalization on new data. This method also demonstrates high accuracy in anomaly detection, which is an important aspect of cybersecurity tasks where correct threat recognition is critical.
Neural networks are a type of deep learning algorithm that simulates the human brain to process complex patterns and features in large data sets. Neural networks consist of different layers of neurons that transform input data, learn from it, and make decisions based on their processing [16, 17, 23]. The formula for activation function:
ReLU ( x )=max ( 0 , x ) , (3) where ReLU ( x ) is the output of the neuron; x is the input value (the sum of the weighted inputs of the neuron).
The basis for this model is the concept of activation functions that determine the output of neurons in the network. ReLU (Rectified Linear Unit) is one of the most popular activation functions that provides fast and efficient data processing in deep neural networks. The use of machine learning in cyber threat detection systems for civil aviation is critical due to the unique challenges faced in this area. The aviation infrastructure is associated with large flows of real-time data, high-security requirements, and the need to quickly adapt to new types of attacks.
All these algorithms can adapt to new threats by learning from the latest data. For example, in the aviation sector, these algorithms can be integrated into systems for traffic control, analyzing the behavior of onboard software, and assessing the cybersecurity risks of airport information systems. In addition, this approach allows for the integration of machine learning into complex incident response systems. For example: automated detection of suspicious requests to the flight control system; detection of deviations in aircraft routes that may indicate intrusion into navigation systems; and monitoring of the behavior of IoT devices at the airport to prevent them from being used as points of attack.
Thus, the use of several methods in combination makes it possible to build a multi-level defense system that not only identifies threats but also adapts to new challenges. This approach makes the system as resilient and reliable as possible, which is crucial for ensuring cybersecurity in critical industries such as civil aviation. The focus of the module for detecting and analyzing cyber threats in the information and communication systems of civil aviation facilities is to determine network traffic metrics (Tables 3 and 4). Such data can be part of training sets for machine learning models in cybersecurity tasks. Network traffic metrics can be an effective tool for detecting and preventing cyber threats in aviation communication channels. Their use will provide an additional layer of protection for critical communications systems against cyberattacks and contribute to the comprehensive security of aviation operations. Metrics can be used to protect aviation communications because they are universal indicators of network traffic and can help detect anomalies or cyber threats such as intrusion attempts, network scans, or DoS/DDoS attacks. The metrics can be used in the context of protecting aviation communication channels:
Metric
Description Subflow Fwd Packets Packets in the forward subflow Subflow Bwd Packets Packets in the reverse subflow FIN Flag Count
Number of FIN packets PSH Flag Count
Number of PSH packets URG Flag Count
Number of URG packets
Reason of less importance Less impactful on overall analysis, useful for in-depth analysis Important for ex-post analysis, but not critical in real time More related to session completion, less commonly used Indicates data transfer immediately, but not always important Rarely used in attack practice, minimal value Fwd Packets/s
Packet rate in the forward direction Less informative than the overall transmission rate These metrics can be used as features for training machine learning models to create an early warning system that automatically detects suspicious activity in the airline channel network, including attacks such as DoS, DDoS, port scanning, etc. Such data can be a part of training sets for machine learning models in cybersecurity tasks. It is important to consider the limitations of system response time and computing resources while processing network traffic in real time. In the context of aviation communication channels, where high reliability, minimal latency, and security are important, it is critical to quickly detect anomalies that may indicate cyber threats or disruptions. Therefore, the authors propose to classify metrics into those that are critical for rapid attack detection and those that can be neglected without significant performance degradation. Metric Flow Packets/s SYN Flag Count
Number of SYN packets RST Flag Count
Number of RST packets Flow Duration
Duration of the stream ACK Flag Count
Number of ACK packets Flow Bytes/s
Byte transfer rate in the stream Bwd Packets/s Total Fwd Packets
Packet rate in the opposite direction Total number of transmitted packets
Detect SYN floods and hacking attempts through session establishment Detects attempts to force termination of sessions Can indicate suspiciously long sessions or delays Monitor connection completion and data transfer confirmations Displays the amount of data transferred, which is important for leak detection Detection of abnormal activity in response to requests Important for analyzing the volume and type of transmission Description
Reason of importance Packet transfer rate in the stream Can detect DoS/DDoS attacks and abnormal changes in traffic Total Backward Packets Total number of packets in the opposite direction
Detecting anomalous responses to requests The authors determine that critical metrics for aviation communication channels (Table 3) are those that can rapidly detect denial-of-service attacks (DoS/DDoS), interception attempts, or data integrity violations (SYN, RST, ACK flags), while secondary metrics are more suitable for offline analysis or improving detailed models, but they are not key to detecting threats in real-time (Table 4). These metrics can be effectively used to analyze the network flows of aviation communication channels. They allow the detection of anomalies and cyber threats in real time, which is critical to ensuring the security of flight control systems, data transmission, and communications between airports and aircraft.
The impact of using metrics: Accuracy: High accuracy is essential to minimize false positives and false negatives. In the aviation industry, it helps to avoid unnecessary alerts and focus on real threats. Precision: High accuracy ensures that many detected threats are genuine attacks, reducing the load on response systems and time spent on verifying false positives. Recall: Recall is critical in real-time networks because it ensures that as many threats as possible are detected, even if they are new or subtle types of attacks. F1-score: It provides a balance between recall and precision, which allows you to optimize the process of detecting attacks without significantly increasing false positives. Latency: For aviation channels, the speed of threat detection is important to prevent potential disruptions of critical systems.
Reducing attack detection delays is a key performance indicator for the model. Use cases: Detecting DDoS attacks: Accuracy and recall metrics provide a quick way to detect anomalies in traffic; XSS and CSRF analysis: F1-score provides accurate identification of threats, even if they are disguised as legitimate requests$ real-time anomaly monitoring: The system can respond quickly to abnormal changes in network traffic due to its recall and reduced latency. The described metrics and combined machine learning models are effective tools for analyzing network flows of aviation communication channels. They provide high accuracy and speed of threat detection, which minimizes the risk of disruption, prevents cyberattacks, and improves the overall security of aviation infrastructure.
The basic architecture of the module consists of several components that collect, process, and analyze data using machine learning methods, and respond to detected threats. Each module performs its specific function, integrating into the overall system to ensure continuous monitoring and protection of the computer network of objects that provide effective detection, analysis, and response to cyber threats:
Data Collection Module. The data collection module performs the key function of threat detection by receiving information about network activity in real-time or by downloading it from pre-saved CSV files. The main scenarios of the module’s operation include two modes: a) Real-time data collection: The module uses an element to monitor network activity. Psutil collects metrics such as the number of bytes and packets sent and received. This process takes place periodically, for example, every 5 seconds, and the result is saved to a data structure for further processing and analysis. b) Downloading data from CSV: The module also supports the ability to load data from CSV files, which enables the use of previously saved datasets. This module is the basis for further processing steps such as data pre-processing and analysis based on machine learning algorithms.
Data pre-processing module. The data pre-processing module performs key operations to clean, normalize, and reduce the dimensionality of the data before it is passed to the machine learning algorithms. Its primary task is to prepare the collected or uploaded data for further analysis, ensuring that it is correct and suitable for use in models. This method standardizes each feature, converting it to a value with a mean of 0 and a standard deviation of 1. This is necessary to improve the performance of machine learning models, especially for algorithms that depend on data scaling, such as SVMs and neural networks. PCA (Principal Component Analysis) is used to efficiently process large amounts of data and prevent model overtraining. This module provides data readiness for the next stage of analysis based on machine learning algorithms, allowing models to work correctly and efficiently.
AI analysis module. The AI analysis module is the core part of the system that detects anomalous activity or threats based on collected and pre-processed data. This module uses several machine learning algorithms to classify data and identify potential cyber threats. The system uses pre-trained models that have been created based on historical data with labels. The module allows both training new models and loading already trained models from files to analyze new data in real-time. The module supports three main types of models: RandomForest, SVM, and MLP. The model evaluation is performed using several metrics to understand how effectively the system detects threats. The main functions of this stage are: model training, which is performed on historical data with labels; during realtime analysis, pre-trained models are loaded; performance evaluation, using metrics to analyze classification results and model accuracy; real-time analysis, using models to detect anomalies in real-time data; various metrics are used to evaluate the performance of machine learning models, such as accuracy, precision, recall, F1-score, area under ROC curve. These metrics provide an objective assessment of the model’s performance in detecting anomalies or cyber threats.
Response module. The Response Module is a critical part of the system that provides automatic response to detected anomalies and cyber threats. Its functionality ensures the prompt sending of notifications to administrators and the implementation of measures to minimize possible threats, such as blocking suspicious IP addresses. As soon as the system detects anomalies or a potential cyber threat, it is necessary to immediately notify the administrator or a contact person who has permission to send emails via SMTP servers. The main advantages of such a system are that alerts are sent to emails in real-time, which allows for a prompt response to potential threats, and that the use of .env files to store credentials increases the security of the notification process. Blocking suspicious IP addresses is one of the most important measures in response to cyber threats. For this purpose, a tool or corresponding commands on other operating systems are used to dynamically block IP addresses at the firewall level.
Data storage module. One of the key requirements of the system is to maintain an event log and store data on detected anomalies and actions taken to neutralize them.
This architecture ensures continuous monitoring, data processing, anomaly detection, and rapid response, contributing to a high level of security for civil aviation information and communication systems.
The evaluation of the models is performed using several metrics to understand how effectively the system detects threats. The main functions of this stage are: model training, which is performed on historical data with labels; during real-time analysis, pre-trained models are loaded; effectiveness evaluation, using metrics to analyze the classification results and accuracy of the models; real-time analysis, using models to detect anomalies in the data collected in real-time; various metrics are used to evaluate the effectiveness of machine learning models, such as accuracy, precision, recall, F1-measure and area under ROC curve. These metrics provide an objective assessment of the model’s performance in detecting anomalies or cyber threats. To assess the accuracy of each model, we also calculated confusion matrices, which display the number of cases in which the model correctly identified threats (positive cases) and normal data (negative cases), and situations where it made a mistake. This tool is useful for evaluating the accuracy of the model, as it indicates how effectively it detects threats and distinguishes them from normal traffic.
Below are the mathematical formulas for each metric.
Accuracy. The ratio of correct predictions to the total number of predictions. This metric can be used to assess the overall performance of the model.
Accuracy =
TP +TN TP +TN + FP + FN , (4) where TP is the number of true positive results (correctly classified attacks); TN is the number of true negative results (correctly classified non-attacks); FP is the number of false positives (not attacks that are mistakenly classified as attacks); FN is the number of false negatives (attacks that are mistakenly classified as non-attacks).
Recall. The rate of true positive cases that were correctly detected by the model. An important metric for assessing the model’s ability to detect all possible threats. 3. Precision. The rate of correct positive predictions among all cases that the model recognized as threats. It helps to estimate the number of false positives. 4. F1-score. The harmonic mean between the accuracy of positive predictions and recall. This is an integrated metric that considers both false positives and false negatives.
Recall=
TP TP + FN
, Precision=
TP TP + FP
, F 1=2 ×
¿ ision × Recall , Precision+ Recall (5) (6) (7)
The area under ROC curve (AUC-ROC). The area under the ROC curve is a measure of the model’s ability to distinguish between positive and negative classes. The values range from 0.5 (random prediction) to 1 (perfect prediction). The proposed combination of machine learning models, such as Random Forest and MLP, has improved the accuracy and stability of the cyberattack detection system for civil aviation information networks (Figs. 2–5), i.e. the test model showed the following results: the accuracy of attack detection was increased by up to 3.35 times and the precision was increased from 1.05 to 1.48 times. The author’s model also provides an increase in sensitivity to attack detection (recall) by up to 1.02 times and an increase in the model’s predictive ability (f1-score) by 1.04 to 2.18 times. The proprietary software solution can detect various threats in real-time, such as DoS (Denial of Service), DDoS (Distributed Denial of Service), XSS (Cross-Site Scripting), CSRF (Cross-Site Request Forgery), and anomalies in network traffic. Thus, the proposed model provides high accuracy due to the combination of several models; the ability to quickly detect cyberattacks in real-time; and the model can adapt to new types of attacks (Table 5).
Threshold-based detection (deviation from the average) Random Forest MLP SVM Combined (Random Forest + SVM + MLP) Combined (Random Forest + MLP) Precision Recall
F1
Accuracy This model allows us to effectively monitor anomalies and detect cyberattacks on aviation communication channels. Such a multi-level system makes it possible to achieve high efficiency in detecting, classifying, and preventing cyber threats in critical communication channels.
These combined machine learning models, in particular Random Forest and MLP, have demonstrated significant benefits in creating a cyberattack detection system for civil aviation information networks. The combination of Random Forest, MLP, and other algorithms has significantly improved the quality of attack detection due to their complementary characteristics. Random Forest is efficient in working with large data sets and has a high resistance to overtraining, while MLP can handle non-linear relationships, which is important for complex threats in the cyber environment.
The results demonstrate the following advantages: 1. Increased attack detection accuracy. The model achieved an increase in accuracy of up to 3.35 times, which indicates its ability to better identify threats. 2. Improved classification accuracy. The model’s accuracy has increased from 1.05 to 1.48 times, which ensures fewer false positives and false negatives. 3. Increased system sensitivity. The sensitivity of the model, which is a critical indicator for detecting new or subtle attacks, has increased to 1.02 times. 4. Increased predictive capability The system’s predictive capability has improved by a factor of 1.04 to 2.18, which confirms its ability to more accurately predict future threats. The results confirm the effectiveness of combining different machine learning algorithms to create a cyberattack detection system capable of operating in a complex and changing civil aviation environment. Such a system enhances the security of information networks by providing an effective response to threats in real-time. The modular architecture of the system allows for the integration of various data sources, pre-processing, and analysis, as well as training and updating of models to adapt to changing conditions. This is critical for aviation systems operating in a dynamic environment with high safety requirements. The integration of analysis and response modules allows for rapid identification of threats and automatic action (e.g., blocking IP addresses), minimizing the impact of cyberattacks. The proposed system architecture can be easily scaled to handle large volumes of traffic and integrated into various information and communication systems. This allows it to be used not only in aviation but also in other critical infrastructure sectors. The implementation of such a system helps to reduce the risks of cyberattacks on civil aviation facilities, including DoS, DDoS, XSS, CSRF, and network traffic anomalies. This significantly improves the security of information resources and communication systems, which is critical to ensuring the stable and safe operation of the aviation industry.
Thus, the developed system for detecting and analyzing cyber threats using combined machine learning models is a reliable solution for improving the level of cybersecurity in the information and communication systems of civil aviation facilities. It combines high accuracy, adaptability, and efficiency, making it an effective tool in the fight against modern cyber threats.
Declaration on Generative AI While preparing this work, the authors used the AI programs Grammarly Pro to correct text grammar and Strike Plagiarism to search for possible plagiarism. After using this tool, the authors reviewed and edited the content as needed and took full responsibility for the publication’s content. [13] A. Ilyenko, et al., Prospective directions of traffic analysis and intrusion detection based on neural networks, Cybersecur. Educ. Sci. Tech. 1(17) (2022) 46–56. doi:10.28925/26634023.2022.17.4656 [14] A. N. Ozalp, Z. Albayrak, Detecting cyber attacks with high-frequency features using machine learning algorithms, Acta Polytechnica Hungarica, 19(7) (2022). [15] R. Kyrychok, et al., Development of a method for checking vulnerabilities of a corporate network using Bernstein transformations, Eastern-Europ. J. Enterp. Technol. 1(9(115)) (2022) 93–101. doi:10.15587/1729-4061.2022.253530 [16] A. Oyetoro, J. Mart, U. Amah, Using machine learning techniques random forest and neural network to detect cyber attacks, ScienceOpen Preprints (2023). doi:10.14293/PR2199.000059.v1 [17] A. Kumar, N. Saxena, B. J. Choi, Machine learning algorithm for detection of false data injection attack in power system, in: International Conference on Information Networking (ICOIN), 2021, 385–390. doi:10.1109/ICOIN50884.2021.9333913 [18] A. Nazir, R. A. Khan, A novel combinatorial optimization based feature selection method for network intrusion detection, Comput. Secur. 102 (2021) 102164. [19] Z. Wang, et al., Intrusion detection methods based on integrated deep learning model,
Comput. Secur. 103 (2021) 102177. [20] D. Dwivedi, et al., Detection of malicious network traffic attacks using support vector machine, in: International Conference on Advanced Network Technologies and Intelligent Computing, 2023, 54–68. [21] P. Semwal, A. Handa, Cyber-attack detection in cyber-physical systems using supervised machine learning, Handb. Big Data Anal. Forensics, (2022) 131–140. doi:10.1007/978-3-03074753-4_9 [22] J. Gu, et al., A novel approach to intrusion detection using SVM ensemble with feature augmentation, Comput. Secur. 86 (2019) 53–62. [23] R. D. Reddy, S. Katkam, C. R. S. Rao, Cyber attacks detection using machine learning, NeuroQuantology, 20(19) (2022) 4388.