Development of identification templates of anomal computer systems status based on control charts

Abstract

The purpose of the article is to propose a method for identifying the state of the computer system based on EWMA control charts and СUSUM charts. The software for construction of templates for fixing abnormal state of a computer system on the basis of traffic analysis was developed. The testing was conducted in the conditions of longterm and short-term DOS-attack, which showed the system efficiency. It was found that the system's operation returns to the limit of both maps in the conditions of a short-term attack. The analysis of the obtained results showed that developed express methods based on control charts increased the reliability of making decision on the state of computer system to 10%.