INVESTIGATION OF METHODS FOR DETECTING ATTACKS ON THE DNP3 PROTOCOL USING MACHINE LEARNING TECHNOLOGIES

The aim of the study is to analyze machine learning methods for detecting attacks on the distributed network protocol (DNP3) in critical infrastructure systems in order to improve the accuracy of classification of malicious traffic and reduce false positives. Research methods: ensemble algorithms, neural networks, as well as methods of logistic regression and fuzzy logic were used. To assess the effectiveness of the models, cross-validation, principal component analysis, and the F-measure metric were used. Results: The study showed that ensemble methods such as random forest and ensemble trees demonstrate the highest accuracy of F-measure = 0.999 in classifying attacks on the DNP3 protocol. The neural network model also achieved high results of F-measure = 0.999 with an optimal configuration of two hidden layers of 10 neurons each. anomaly detection tasks. Logistic regression and the naïve Bayesian classifier turned out to be less accurate due to the limitations associated with linear dependencies and the assumption of feature independence. The PCA analysis revealed that for most models, the optimal number of components ranges from 8 to 47, while further increasing the number of components does not lead to a significant improvement in accuracy. The results highlight the superiority of ensemble approaches in cybersecurity tasks, especially when working with structured network traffic data. Scientific novelty: the paper proposes an integrated approach to detecting attacks on the DNP3 protocol, combining machine learning methods with hyperparameter optimization and data preprocessing. The novelty of the research lies in the comparative analysis of the effectiveness of ensemble methods and neural networks for this task, as well as in the identification of optimal model configurations that provide high accuracy with minimal risk of overfitting. Contribution of the authors: Lapina M. A. – general management of the project, development of the general concept of work and research methodology, coordination of the team's work, as well as analysis and interpretation of the results obtained; Shchepina D. I. – conducting an experiment, implementation of machine learning algorithms in the KNIME environment, setting up and optimizing models and preparing data for analysis; Lapin V. G. – development of a methodology for data preliminary processing, selection of significant features, analysis of the main component (PCA) and preparation of the technical documentation of the study; E.A. Kenkov – comparative analysis of the effectiveness of various machine learning methods, development of recommendations for optimizing model parameters, as well as preparation of the text part of the publication, including the presentation of results and drawing conclusions.