There are many machine learning algorithms, so the information security specialist is faced with the task of deciding on an algorithm that will demonstrate the highest results of correct response to threats. As part of the study, a comparative analysis of the results of the application of seven machine learning algorithms in SBA - Naive Bayes, QDA, Random Forest, Decision Trees, AdaBoost, MLP, KNN was performed. Training and testing of the SBA model was performed on the basis of the CICIDS- 2017 dataset. The use of this sample in the research is due to the presence of records of modern attacks such as Brute Force, DoS, HeartBleed, WebAttack, Infiltration, Botnet, DDoS, which makes it more relevant to the current research.

As of today, the detection of network traffic anomalies is an urgent task of ensuring the information security of any enterprise. The value of the information that is processed and stored in the ICS of enterprises increases, thereby increasing the motivation of criminals to obtain NSD for this information. Therefore, there is a need to implement a solution that will minimize the risk of attacks on information via the Internet. A modern and effective solution for an enterprise against threats of this type is the implementation of network traffic monitoring based on a machine learning algorithm. There are many machine learning algorithms, so the information security specialist is faced with the task of deciding on an algorithm that will demonstrate the highest results of correct response to threats. As part of the study, a comparative analysis of the results of the application of seven machine learning algorithms in SBA - Naive Bayes, QDA, Random Forest, Decision Trees, AdaBoost, MLP, KNN was performed.