Abstract
The study examines the issue of identifying anomaly network traffic in the enterprise telecommunications network, based on the use of data mining methods. A method for detecting anomalies is proposed using a clustering algorithm to segmentation the analyzed data sample. The main difference between the proposed method and existing ones is the combination of clustering and classification methods in order to improve the accuracy of detecting attacks of unauthorized connection to the system in the real network traffic. The method can be used both in real time and for periodic information security audits, which is part of a set of measures for monitoring the state of an enterprise telecommunications network. The method involves dividing the entire sample into disjoint subsets - clusters. Then, classification algorithms will be applied to each of the clusters for training and testing. The proposed method makes it possible to increase the accuracy of identifying unauthorized connections to critical systems of telecommunications infrastructure of companies.