DEVELOPMENT OF METHOD TO IDENTIFY THE COMPUTER SYSTEM STATE BASED ON THE «ISOLATION FOREST» ALGORITHM

• Published in: Radìoelektronika, informatika, upravlìnnâ Vol. 1; no. 1; pp. 105 - 116
• Main Authors: Gavrylenko, S. Y., Sheverdin, I. V.
• Format: Journal Article
• Language: English; Ukrainian
• Published: 27.03.2021
• ISSN: 1607-3274; 2313-688X
• DOI: 10.15588/1607-3274-2021-1-11

Context. The problem of identification a computer system state was investigated. The object of the research is the identification process of the computer system state. The subject of the research is computer system state identifying means and methods. Objective. The purpose of the work is to develop a method for identifying the computer system state. Method. The method has been developed for identifying a computer system state based on integrated use the procedure for grouping unlabeled initial data and using machine learning technology based on the «Isolation Forest» algorithm, which provides to identify a computer system state and to distinguished the process name that initiated the abnormal state. Therefore, for collecting statistical data in the form of operating system functioning events, data method has been proposed and developed along with software. The analysis of functioning events has been performed. The result of analysis showed that the most informative are read and write operations. To set up a single dataset, read and write operations compared with the process name and combined into one array of event groups, so that it is possible to single out the process that causes the abnormal state of the computer system. As a result of the research, the «Isolation Forest» algorithm has been selected as a component of the method for identifying the computer system state. An accuracy and efficiency assessment of the developed method of identifying a computer system state has been carried out. Results. The developed method is implemented and investigated when solving the problem of identifying anomalies in the functioning of computer systems. Conclusions. The experiments carried out confirmed the efficiency of the proposed method. It allows us recommended the method for practical use in order to improve efficiency of identifying the computer system state and use it as an express method. Areas for further research may lie in the creation of the ensemble of fuzzy trees based on the proposed method and optimization of this software implementation.