title: ÐÐ¾Ð´ÑÐ»Ñ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Behavioral analysis module for information security events
Creators: name: ÐÐ°ÑÑÑÐ¸ÑÐµÐ², ÐÐ¼Ð¸ÑÑÐ¸Ð¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
ÑÐ´Ð°Ð»ÐµÐ½Ð½ÑÐ¹ Ð´Ð¾ÑÑÑÐ¿
ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð´Ð¾ÑÑÑÐ¿Ð°
Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³ Ð¸ Ð°Ð½Ð°Ð»Ð¸ÑÐ¸ÐºÐ°
information security
remote access
access control
monitoring and analytics

description: Ð¦ÐµÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ â ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿Ð¾Ð»Ð¸ÑÐ¸ÐºÐ¸ Ð² Ð¼Ð¾Ð´ÑÐ»Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð´Ð»Ñ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ ÐÐ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÐµÑÑÑ Ð¼ÐµÑÐ¾Ð´Ð¸ÐºÐ° ÐºÐ¾Ð½ÑÐ¸Ð³ÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ¾Ð² Ð´Ð»Ñ Ð¿Ð»Ð°Ð½Ð¾Ð¼ÐµÑÐ½Ð¾Ð³Ð¾ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ, Ð´Ð¾ÑÑÐ¸Ð¶ÐµÐ½Ð¸Ñ Ð¾Ð¿ÑÐ¸Ð¼Ð°Ð»ÑÐ½ÑÑ Ð·Ð½Ð°ÑÐµÐ½Ð¸Ð¹ Ð»Ð¾Ð¶Ð½ÑÑ ÑÑÐ°Ð±Ð°ÑÑÐ²Ð°Ð½Ð¸Ð¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾ÑÐ°Ð±Ð¾ÑÐ°ÑÑ ÑÑÐµÐ¼Ñ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ. 2. ÐÐ¿Ð¸ÑÐ°ÑÑ ÑÑÐ°Ð½Ð´Ð°ÑÑÐ½Ð¾Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¸Ð²Ð¸Ð»ÐµÐ³Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ Ð¸ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ°. 3. ÐÐ¿Ð¸ÑÐ°ÑÑ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼Ñ Ð¿ÑÐ¸ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ° Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. 4. ÐÐ½ÐµÐ´ÑÐ¸ÑÑ Ð¼Ð¾Ð´ÑÐ»Ñ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. 5. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¿Ð¾Ð»Ð¸ÑÐ¸ÐºÑ Ð¿Ð¾ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ¾Ð². Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» Ð²Ð½ÐµÐ´ÑÐµÐ½ Ð¼Ð¾Ð´ÑÐ»Ñ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. Ð Ð¼Ð¾Ð´ÑÐ»Ñ Ð±ÑÐ»Ð¸ Ð¿Ð¾Ð´ÐºÐ»ÑÑÐµÐ½Ñ Ð¸Ð½ÑÑÐ°Ð»Ð»ÑÑÐ¸Ð¸ ÑÐ¸ÑÑÐµÐ¼ Ð¿Ð¾ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ¾Ð², ÑÐ°Ð·Ð²ÐµÑÐ½ÑÑÑÑ Ð² ÑÐ°Ð·Ð½ÑÑ ÑÐµÐ³Ð¸Ð¾Ð½Ð°Ñ. ÐÐ¾Ð´ÑÐ»Ñ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð½Ð°ÑÐ°Ð» Ð¿Ð¾Ð»ÑÑÐ°ÑÑ Ð´Ð°Ð½Ð½ÑÐµ Ð¾Ñ ÑÐ¸ÑÑÐµÐ¼ Ð¿Ð¾ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ¾Ð². ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ ÐºÐ¾Ð½ÑÑÐ¾Ð»Ñ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ¾Ð² Ñ Ð¿Ð¾ÑÐ»ÐµÐ´ÑÑÑÐµÐ¹ ÑÐµÐ³Ð¸ÑÑÑÐ°ÑÐ¸ÐµÐ¹ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸.
description: The goal of the work is to develop a policy within the behavioral analysis module for information security events to respond to security incidents. The subject of the study is the methodology for configuring parameters for systematic machine learning to achieve optimal false-positive rates. Tasks to be solved during the study: 1. Develop the infrastructure scheme. 2. Describe the standard behavior of a privileged user and a potential attacker. 3. Describe the problem of investigating security incidents. 4. Implement the behavioral analysis module for information security events. 5. Develop a policy for monitoring the actions of system administrators. As a result of the work, a behavioral analysis module for information security events was implemented. The module was connected to installations of systems for monitoring the actions of system administrators deployed in different regions. The behavioral analysis module started receiving data from these systems. The obtained results can be used as a basis for monitoring the actions of system administrators with subsequent registration of information security incidents.