Modern cyber threats are characterized by a high degree of adaptability, secrecy and variability. This fact makes the task of their timely detection in network traffic one of the key problems in the field of cyber security of informatization objects. Traditional methods based on signatures and rigidly defined rules do not provide sufficient flexibility to detect previously unknown or modified attacks. Consequently, the relevance of developing new hybrid intelligent systems capable of taking into account the behavioral characteristics of traffic and adapt to its dynamics is increasing. The paper proposes a hybrid method for detecting cyber threats that combines the advantages of ensemble clustering and Bayesian probabilistic modeling. In the first stage, a machine learning model extracts the hidden behavioral features of network connections using multiple clustering algorithms. And the obtained behavioral embeddings are further used as input variables to construct a Bayesian network that models the probabilistic dependencies between behavioral attributes and anomaly attributes. The outlined approach will allow not only to detect abnormalities in traffic, but also to ensure the interpretability of the adopted security decisions. The practical significance of the proposed method lies in the potential of its integration into traffic monitoring systems in corporate and distributed network infrastructures.
Computer networks of informatization objects, being in a state of constant development. And as
information technologies evolve and business processes become more dependent on network
operations, they become increasingly vulnerable to a wide range of cyber threats. Such cyber threats
manifest themselves in the form of attacks of different nature, ranging from unauthorized access to
complex multi-stage intrusions [
This paper considers a new hybrid approach to network traffic analysis combining machine learning (ML) and probabilistic modeling methods based on Bayesian networks (BN). The proposed method is based on multi-stage processing of observed network features. First, latent behavioral representations reflecting the structure of interactions and behavioral heterogeneity of network activity are extracted using ensemble clustering. And then a Bayesian model is built based on them,
0000-0001-9695-4543 (V. Lakhno); 0009-0006-8743-5606 (S. Mamchenko); 0000-0002-2284-3418 (A. Desiatko); 0000-00016599-0808 (B. Bebeshko); 0009-0000-9242-5572 (I. Mirko) allowing probabilistic inferences about whether the traffic belongs to normal or abnormal category. The method proposed in this paper integrates the advantages of trained behavioral models and explainability of probabilistic structures, providing high adaptability to the variety of cyber threats while maintaining the interpretability of the results obtained.
Modern cybersecurity challenges require comprehensive approaches that integrate secure system
design, effective data protection, and adaptive threat response mechanisms. For example, methods of
secure digital system design, including protection against SQL injection and related attacks,
demonstrate the importance of embedding security at all stages of system development [
The problem of detecting cyber threats in network traffic is formulated as the problem of detecting
anomalous behavior that characterizes potentially dangerous or malicious activities in the flow of
network connections. The main difficulty is that attacker behavior may vary from case to case.
Consequently, such data will not be pre-represented in training samples (which is the basis for many
researchers, e.g., in [
Existing methods [
The objective is to develop a method capable of detecting cyber threats based on behavioral analysis of network traffic, relying on latent patterns detected by ML and a Bayesian network (BN) adept at modeling probabilistic relationships between behavioral characteristics and anomalies.
Step 1: Extraction of behavioral features using ensemble clustering.
Let there is a sample of network traffic:
χ= { x(1) , x(2) , … , x(n)} , x(i) ∈ R d , duration, bytes, protocol, etc.).
Next, we select a set of M clustering algorithms: z(i)= C j ( x(i)).
j
Then we obtain the following intermediate result where x(i)= ( x(1i) , x(2i) , … , x(di)) is the vector of features for ith network connection (connection
C = {С 1 , С 2 , … , С M } .
Here, each С j is a function С j : Rd⟶ { 1,2 , … , K j } that mps a cluster label x(i) to each vector
M Z(i)= ( z(1i) , z(2i) , … , z(Mi) ) ∈ ∏ {1 , … , K j }.
j= 1 At this stage, the goal is to identify hidden behavioral patterns in network traffic by applying several clustering algorithms to the data. This allows us to form a generalized view of possible traffic patterns. For example, suppose that each object in the sample is a distinct network connection described by a vector of features. As we mentioned earlier, e.g., connection duration, number of bytes transferred, protocol type, etc. This data is input to several clustering algorithms that make up the ensemble. Such well-known methods as K-means, DBSCAN, hierarchical clustering, spectral clustering and others can be chosen as algorithms. Note that the choice of specific algorithms for an ensemble is determined by considering several factors. Among these factors we consider differences in density and distance approximation methods (density methods or metric methods), sensitivity to the shape and size of clusters, robustness to noise and outliers, and scalability when dealing with large volumes of traffic. Therefore, by applying each of the algorithms to the raw data, we obtain that each network connection is assigned to a cluster. Thus, each connection is assigned a label, i.e., the cluster identifier to which it is assigned by the algorithm. Since multiple algorithms are used, a vector of labels is generated for each connection, where each component corresponds to the result of clustering by one of the methods. The intermediate result of this step is then the so-called “cluster representation” of the connection behavior. This is the set of cluster labels obtained from the results of all ensemble methods. This set of labels should not be interpreted directly as features in the classical sense. Instead, it serves as a basis for further construction of numerical behavioral features reflecting the consistency or divergence in the estimates of the different clustering methods. These features will be used as input variables in the probabilistic model of the Bayesian network at the next stages of the method, allowing it to take into account and interpret the behavioral patterns revealed by clustering.
To move to a numerical vector of behavioral traits, a mapping is used:
M Φ : ∏ {1 , … , K j }⟶ R k , (3)
j= 1 where Φ is a mapping (function) that transforms the original cluster labels into a vector of behavioral features. I.e., Φ performs the role of embedding, taking the clustering results (cluster labels from each algorithm) and transforming them into a numerical vector of fixed length; K j is the result of the jth clustering method (from an ensemble of M methods) over object xᵢ. Or K j ( x j ) is the cluster label assigned by the jth clustering method for ith network connection; R k is a vector of k real numbers. The cluster embedding vector for the i-th network connection is a feature vector of dimension d, suitable to be fed to the BN input. The dimensionality depends on the number of methods in the ensemble (M), and the number of clusters output by each method.
Then, after a vector of cluster labels obtained from several clustering algorithms has been
generated for each network connection, there is a need to convert this vector into a numerical
representation. This representation should be suitable for further analysis within a Bayesian model.
This transformation is called cluster embedding [
Combining everything, we get an embedding of length 11. That is, [
The main goal is to provide the BN with “clean” and high-level attributes that reflect the structure of behavior, not just technical traffic parameters. Accordingly, the BN does not work with raw data, but with stable and interpretable behavioral characteristics. This is essential for the task of detecting anomalies in the network, where “anomaly” itself is most often manifested as a behavioral deviation from the norm.
We end up with a behavioral profile of an object x(i), extracted based on cluster membership.
Then the next step is to build a Bayesian network on top of the extracted features. A Bayesian
network is a probabilistic model describing the relationship between random variables [
Stage 2: Formalize the composition of BN nodes.
Let us let Z = ( Z 1 , Z 2 , … , Z k ) is a variables corresponding to the components h(i) ; A∈ {0,1} is a binary random variable reflecting anomaly (A = 1 is an anomaly, A = 0 is a standard).
Here h(i) is the hidden (latent) variable characterizing the anomaly of the ith object. For example, a network connection. This is not a directly observable characteristic, but a latent hypothesis about whether the object belongs to the class of “normal traffic” or “anomaly”. In fact, it is a target node in the BN modeling the hypothesis of whether an object is a potential cyber threat.
We combine all variables into a set v= (Z1 , … , Zk , A). The set v represents the complete set of
variables used in the BN. We combine them to define the structure of the BN. Or, in other words, to
establish between which variables probabilistic dependencies can exist. Also, v is needed to specify
the factorization domain, since the BN is constructed as a factorization of the joint distribution of all
variables from v, using a directed acyclic graph (DAG) [
The network structure, represented as an oriented acyclic graph, serves as a “framework” for modeling probabilistic relationships between variables. By determining which nodes (variables such as the latent variable characterizing abnormality and extracted behavioral traits) are directly connected, we form the basis for factoring the joint probability distribution. In other words, this means that each variable in the network is considered together with the set of its immediate antecedents, thus allowing an adequate description of its probabilistic behavior. The transition to a joint distribution is made by decomposing the full probability measure into a product of conditional distributions, where each component corresponds to a node in the graph and depends only on the variables to which it is directly related in the structure (in other words, on its parents in the graph).
The joint distribution in the BN is defined as follows:
P (Z1 , … , Zk , A)= ∏ P (v| pa (v )),
v∈ V where pa ( v ) | V is a set of node parents v .
The main goal is to compute the posterior distribution of the:
P ( A= 1| Z1 = z1 , … , Zk= zk), (4) (5) which is the prediction of the anomaly probability for the object x(i)
The joint distribution expresses the complete set of dependencies extracted during graph construction and then allows for the conditional probability calculations required for cyber threat detection. Consequently, combining the concepts of the method steps of deriving the BN structure and the joint distribution reflects the fundamental idea of the Bayesian approach, in which a predefined dependency structure defines the rules by which the complex probability distribution underlying the network traffic anomaly detection model can be decomposed and described.
After formalizing the joint distribution of all variables included in the BN structure, the next logical step is the model training procedure. BN training is a process of determining numerical parameters corresponding to conditional probabilities in the nodes of the graph. For each variable included in the network, it is required to estimate its conditional distribution given by its parents in the dependency graph. If the network structure is fixed in advance (e.g., relying on a priori knowledge of experts), the learning task is reduced to estimating the parameters of the distributions. In the case of discrete variables, which include both the latent variable reflecting anomaly and the features obtained from cluster embedding, training is performed by calculating the relative frequencies of the training sample. Then, likelihood maximization, i.e., parametric tuning of the model so that it best explains the observed network traffic data, is provided. Actually, BN training represents the central stage of our method. At this stage, the probabilistic model acquires a concrete numerical content that reflects the statistical relationship between traffic behavioral attributes and the anomaly hypothesis. The trained model will later serve as a basis for probabilistic inference, allowing us to assess the degree to which new network connections belong to potentially dangerous ones based on their behavioral profile.
The proposed method for analyzing network traffic to detect cyber threats can be conceptualized in the form of expression (6) or a conceptual diagram of a formalized algorithm, see Figure 1.
In other words, the method can be conceptualized as a composition of sequentially applied mappings, see expression (6). And each of them implements a certain functional transformation over the data, bringing us closer to the formation of a probabilistic model of behavior. x(i) C Z(i) Φ h(i) BN inference P ( A= 1| h(i) ). (6)
→ → →
The input is the observed characteristics of network connections, representing low-level network features x(i). These data pass through a machine learning block, in particular ensemble clustering, which results in the transformation of the original observations into a behavioral representation. This stage can be interpreted as the first mapping. This first mapping identifies hidden behavioral patterns characteristic of different types of activity in the network and encodes them as embeddings.
The next step is the second mapping, the construction of a Bayesian network on the obtained embeddings, i.e., h(i) BN inference P ( A= 1| h(i) ). This mapping establishes probabilistic → relationships between behavioral attributes and the connection anomaly hypothesis, allowing us to combine the behaviors captured by clusters with a probabilistic model adapted to account for uncertainty, causality, and partially observed data.
The final model is thus a composite of transformations sequentially moving from the original network attributes to a probabilistic risk assessment.
In Figure 1, a(i) is a binary (or categorical variable) indicating which class the network connection actually belongs to. And the parameter ^A(i) is the model prediction, i.e., the result of probabilistic inference in BN. Usually ^A(i) means ^A(i )= { 1 , if P ( h(i )=1|z (i ) )>τ , 0 , else , (6) where τ is the preselected threshold.
For example, a(i) is a true label from the dataset used for quality assessment. Then ^A(i) is the prediction of the model, i.e., the result of Bayesian inference about traffic anomalies.
The proposed approach is a development of existing methods for detecting anomalies in traffic, and combines the ideas of behavioral analysis and probabilistic inference. The key novelty of the proposed solution is the use of ensemble clustering as a mechanism for extracting hidden behavioral features, which are then used not just for classification, but for building a dynamically adaptive BN. Such a network not only identifies threats, but is also able to account for the variability of network activity. For example, this is relevant in the face of constantly evolving cyber threats. We believe that the method outlined in this paper, extends the classical “clustering → labeling” scheme and proposes a flexible hybrid model. The model eventually combines empirical behavior and probabilistic interpretation, giving the outlined method a good.
The hybrid method of network cyber threat detection proposed in this paper combines the capabilities of behavioral modeling and probabilistic inference. The method forms an approach to analyzing network traffic under conditions of uncertainty of initial parameters for traffic analysis. The use of ensemble clustering in the method at the first stage will allow to extract stable and informative representations of behavioral features. And the construction of a Bayesian network on their basis at the second stage, respectively, will ensure the feasibility of interpretable inference and consideration of causal dependencies between traffic parameters and threats to network security. The approach presented in the paper allows us to flexibly adapt the model structure to changes in user behavior and the dynamics of attacking strategies. It should be noted that the presented conceptual scheme of the formalized algorithm for the hybrid method of detecting cyber threats in network traffic opens a number of directions for further research. In our opinion, it is promising to develop methods of automatic learning of the BS structure based on the analysis of traffic dynamics. As well as the introduction of additional sources of information, such as temporal and/or contextual dependencies, into the learning model.
While preparing this work, the authors used the AI programs Grammarly Pro to correct text grammar and Strike Plagiarism to search for possible plagiarism. After using this tool, the authors reviewed and edited the content as needed and took full responsibility for the publication’s content.