Development of a Decision Support System Based on Bayesian Networks to Improve the Effectiveness of Detecting Intrusions into Computer Systems

Authors

  • Bakhytzhan Akhmetov International University of Transportation and Humanities, Almaty
  • Valery Lakhno National University of Life and Environmental Sciences of Ukraine, Kyiv
  • Ayaulym Oralbekova 1 Kazakh University Ways of Communications, Almaty, Kazakhstan 2 Academy of Transport and Communications named after M. Tynyshpayev, Almaty, Kazakhstan
  • Auezkhan Turdaliev International University of Transportation and Humanities, Almaty
  • Akbala Abuova International University of Transportation and Humanities, Almaty
  • Myroslav Lakhno National University of Life and Environmental Sciences of Ukraine, Kyiv

Abstract

Investigating complex cybercrimes, including organizing or participating in DDoS attacks, is becoming increasingly important in today's world that relies on information technology and computer systems in various fields of activity. Our study substantiates the feasibility of using the potential of Bayesian network models (or Bayesian networks BN) for the analysis of cybercrimes, using the example of DDoS attacks, which allow to take into account many variables and probabilities in such crimes, for example, when teaching students in specialties related to information security (IS). We proposed a modified BN model to identify the culprit in organizing a DDoS attack or participating in its implementation, including additional hypotheses in the model. As additional hypotheses, the work examines artifacts related to the fact that the suspect had a motive for carrying out the attack and has the necessary technical knowledge. Evidence supporting these hypotheses includes identifying the attacker's motive and the technical knowledge required to carry out a DDoS attack. The study of such models will help to perform forensic analysis more deeply, based on clear mathematical dependencies and eliminate subjectivity. The proposed model develops the work of other authors and helps to identify connections in the BN in more detail. A description of the software implementation in Python of such a training program based on BN is proposed. This software product is aimed at increasing the effectiveness of such tools, making them more practice-oriented and expanding opportunities for both students and specialists to analyze cybercrimes related to DDoS attacks.

Author Biography

Ayaulym Oralbekova, 1 Kazakh University Ways of Communications, Almaty, Kazakhstan 2 Academy of Transport and Communications named after M. Tynyshpayev, Almaty, Kazakhstan

PhD, Международный транспортно-гуманитарный университет, Алматы, Казахстан

Additional Files

Published

2026-07-17

Issue

Section

Control, Automation and Robotics