Development of an intelligent subsystem for operating system incidents forecasting

• Main Authors: Valeriy Lakhno, Andriy Sagun, Vladyslav Khaidurov, Elena Panasko
• Format: Article
• Language: English
• Published: PC Technology Center 2020-03-01
• Series: Technology Audit and Production Reserves
• Subjects: time series; forecasting subsystem; machine learning; polynomial model; method of group accounting of arguments.
• Online Access: http://journals.uran.ua/tarp/article/view/202498

The object of research is a subsystem for prediction server platform’s incidents, which operates on the basis of the Windows OS family. One of the most problematic places when planning measures to prevent the harmful effects of network attacks such as dDOS, hardware failures etc for the server system is to obtain an effective model for predicting incidents of the operating system. In the course of the research, methods of formation and research of the time series, exponential smoothing, elements of the theory of machine learning based on the method of group accounting (GMDH) are used. To obtain accurate and reliable forecasts of the operation of the intellectual subsystem for forecasting incidents, elements of the theory of heuristic self-organization and a specific implementation of this theory, the GMDH, are used. An algorithm is obtained and a software implementation of an intelligent system for predicting incidents of operating system operation and the main characteristics of its operation is developed. This became possible as a result of the analysis of the constructed model of the intruder, the system log of security incidents and the use of the GMDH. A mechanism is proposed for generating a sample of OS incident events based on the Windows system event log. The testing of the proposed forecasting system based on test samples allows to state that the forecasting results obtained with various settings of the machine learning system and parameters (degree of the reference polynomial, number of variables in the characteristic polynomial model, number of selection series) are satisfactory. As a result of applying the created algorithm for forecasting incidents of OS operation, it is shown that the use of a large number of polynomial models in GMDH allows one to obtain a forecasting system that is qualitatively superior to systems based on classical regression models and methods. Due to this, a much more accurate forecast can be obtained than the classical regression methods or the method of exponential smoothing, compared with similar methods. The percentage of false calculations using GMDH is less than 4 %.