Аннотация
The last decades were marked by a rapid growth in using of information technologies in various areas of civiliza-tional practices. This confirms the course on digitalization of business processes, particular in the transport industry of the Republic of Kazakhstan. The tendency to digitali-zation of the economy and integration into business pro-cesses of various information and communication sys-tems, obliges to take into account emerging incidental risks. First of all, the part, which is connected with the protection of information and the cybersecurity of digital systems. In the tasks of cyber defense, cognitive technol-ogies for detecting and recognizing intrusions are increas-ingly being used. In the conditions of growing number of destabilizing influences on information and communica-tion systems, including transport, involving a variety of digital technologies, further scientific research is needed to develop the theoretical and methodological founda-tions for the synthesis of intelligent, self-taught intrusion detection systems. It is shown that the process of cyber defense for information and communication systems, in particular transport, is controlled and analyzed according to the values of several parameters of the signs of anom-alies, cyber-attacks and threats. There are considered ad-ditions to methods of selecting informative features for training samples used in intrusion detection systems in this work. It is shown that the most simple, and at the same time effective, from the point of view of hardware and software implementation in such systems are filter methods. Additions are proposed to filter methods in the tasks of minimizing training samples in systems for de-tecting anomalies, attacks and threats. It is shown that the most simple, and at the same time effective, from the point of view of hardware and software implementation in such systems are filter methods. It is shown that the filtering methods allow to perform the estimation of in-formativeness for the subset of characteristics suffi-ciently, in particular to reduce the low-information char-acteristics, the analysis of which makes the detection and classification of anomalies, cyber-attacks and threats dif-ficult.