The new development, combining advanced mathematical models and large language models, analyzes the development of network events over time and allows detecting both known and previously unknown types of cyber attacks, ensuring high accuracy of threat detection in real time.
In today's digital environment, a cyberattack rarely looks like one high-profile hack. Previously, an attack could take several seconds or minutes, but today it can take weeks or even months to unfold. More often, attackers act gradually: they first study the system, then check for weaknesses, and only then proceed to action. That is why it is becoming increasingly difficult to detect an attack in time and take the necessary actions.
Graduate student of the National Research Nuclear University MEPhI Roger-Nick Anaedevkha (scientific supervisor – Associate Professor of the Department of Cybernetics, PhD, Alexander Trofimov) offers a new perspective on solving this problem. The authors proceed from a simple idea: in order to recognize a threat in time, it is not enough to analyze only individual events on the network. It is necessary to understand how these events are interconnected in time. One suspicious request does not mean anything, but if such requests appear in a certain sequence and at certain time intervals, then together they may indicate the preparation of a serious attack.
Most of the existing intrusion detection systems operate on the principle of periodic verification. It's like they're taking photos of what's happening at the same time intervals. This approach works well when events occur regularly, but the actual network activity is far from uniform. Sometimes nothing suspicious happens on the network for a long time (preparations for an attack are underway), and then thousands of events occur in a split second. To overcome this limitation, researchers at the National Research Nuclear University MEPhI have created a hybrid TA-BN-ODE architecture that combines two powerful mathematical tools:
• Neural Ordinary Differential Equations (Neural ODES), modeling the development of network processes in continuous time and occurring on various time scales – from microseconds to months;
• Deep spatial-Temporal Point Processes (Deep Spatio-Temporal Point Processes) for analyzing the sequence of events in time and estimating the likelihood of suspicious actions in the future.
When developing the architecture, the authors pay attention to two important problems of cyber defense and propose methods to solve them.
-
Assessment of uncertainty. Most algorithms give only the final answer: "attack" or "not attack". However, it is not known how confident the model is in her decision. The work uses Bayesian methods to assess the degree of confidence of the algorithm. This is especially important in real-world security monitoring centers, where millions of warnings are received daily. If the system is able to show how confident it is in each detected incident, specialists can first check the most dangerous cases and not waste time on false alarms.
-
Detection of new types of attacks. To solve this problem, the authors used a large language model that analyzes sequences of events in text form and performs reasoning similar to that of a cybersecurity expert. As a result, the accuracy of detecting zero-day attacks on the CIC-IoT-2023 benchmark reached 87.6%, while traditional methods based solely on searching for known patterns demonstrated only about 42%. This indicates a shift from a reactive approach to protection to a proactive one, where the system is able to recognize threats that were not present in the training data.
To experimentally test their system, the researchers conducted large-scale experiments on several well-known datasets containing almost 19 million records of network activity. In experiments, the new system has shown a very high accuracy in detecting attacks – up to 99%. The development of the MEPhI scientists is much more compact than many modern analogues, having 80% fewer parameters than the transformer-based model, while not inferior in accuracy. In addition, due to its lightness (the model takes up only 9.2 MB of RAM) It is capable of analyzing more than 12 million events per second with a delay of less than one tenth of a second, which allows it to be used in real-time security systems.
The results of the MEPhI scientists, published in the prestigious scientific journal Complex & Intelligent Systems, show the promise of combining continuous neural models, spatiotemporal point processes, Bayesian inference and large language models within a single cybersecurity architecture. The proposed approach allows not only to increase the accuracy of attack detection, but also to make security systems faster, more economical, clearer for specialists and more resistant to new threats.
