Method for detecting computer attacks based on adaptability and balancing of training samples

The relevance of this work is determined by the fact that modern cyber defence systems still face the problem of data imbalance in detecting computer attacks. Uneven class representation reduces the ability of machine learning models to recognise rare but critically important types of intrusions. Existing methods of synthetic sample augmentation often distort the data structure and lead to the loss of characteristic attack signatures, which negatively affects the reliability of classification. The aim of the study was to improve the accuracy and completeness of network attack detection by developing an adaptive method for balancing the training sample while preserving the statistical and signature properties of anomalies. The research methodology involved the creation of a deterministic algorithm that calculated the supplementation coefficients separately for each type of attack, taking into account its frequency and the minimum required sample size. A statistical approach based on local medians and extreme values of neighbouring samples was used to generate new examples, which ensured the reproduction of the typical structure of anomalous patterns without random interpolation. The developed method was integrated into a data processing sequence, within which network traffic parameters were converted into sound signals, and spectrograms were formed on their basis for further analysis by a two-dimensional convolutional neural network. The main results of the study showed an increase in the completeness of detection of rare types of attacks by an average of 10-12% compared to basic approaches, while maintaining a stable level of overall accuracy. Preserving signatures in synthetic samples ensured improved recognition of rare attacks and increased classification reliability. The practical value of the work lies in the possibility of applying the developed method to form balanced samples in intrusion detection systems and its integration with existing deep learning models in order to improve the reliability of corporate network cyber protection