title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð³ÑÐ°ÑÐ¾Ð² Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ ÑÑÐ±ÑÐµÐºÑÐ¾Ð² Ð¸ Ð¾Ð±ÑÐµÐºÑÐ¾Ð² Ð² Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ðµ Windows
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detection of targeted attacks based on the analysis of interaction graphs of subjects and objects in the Windows operating system
Creators: name: ÐÐ»Ð¸Ð¼Ð¾Ð², ÐÐ½Ð´ÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÐµ Ð°ÑÐ°ÐºÐ¸
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
Ð³ÑÐ°Ñ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ
Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹
advanced persistent threats
machine learning
provenance graph
anomaly detection

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð³ÑÐ°ÑÐ¾Ð² Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ ÑÑÐ±ÑÐµÐºÑÐ¾Ð² Ð¸ Ð¾Ð±ÑÐµÐºÑÐ¾Ð² Ð² Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ðµ WindowsÂ». ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð¸ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº. Ð¦ÐµÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ â Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð² ÐÐ¡ Windows Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð³ÑÐ°ÑÐ¾Ð² Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ ÑÑÐ±ÑÐµÐºÑÐ¾Ð² Ð¸ Ð¾Ð±ÑÐµÐºÑÐ¾Ð² Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. Ð Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ðº Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº, Ð²ÑÐ´ÐµÐ»ÐµÐ½Ñ Ð¸Ñ Ð¿ÑÐµÐ¸Ð¼ÑÑÐµÑÑÐ²Ð° Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¸. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ» Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº, Ð² Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¼ÐµÑÐ¾Ð´Ð° Ð»ÐµÐ¶Ð¸Ñ Ð¸Ð´ÐµÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð³ÑÐ°ÑÐ¾Ð²Ð¾Ð³Ð¾ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ñ Ð¿ÑÐ¾ÑÐµÑÑÐ¾Ð² Ñ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÐ¼Ð¸ Ð¾Ð±ÑÐµÐºÑÐ°Ð¼Ð¸ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. ÐÑÐ»Ð¸ÑÐ¸ÑÐµÐ»ÑÐ½ÑÐ¼Ð¸ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÑÐ¼Ð¸ ÑÑÐ¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ¾, ÑÑÐ¾ Ð²ÐµÑÑ Ð³ÑÐ°Ñ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ Ð²Ð·Ð°Ð¸Ð¼Ð¾Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ Ð½Ð¸ÐºÐ¾Ð³Ð´Ð° Ð½Ðµ ÑÑÐ°Ð½Ð¸ÑÑÑ Ð² Ð¿Ð°Ð¼ÑÑÐ¸ Ð¿Ð¾Ð»Ð½Ð¾ÑÑÑÑ. ÐÑÐ¾ÑÐ°Ñ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÑ Ð·Ð°ÐºÐ»ÑÑÐ°ÐµÑÑÑ Ð² Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ð¸ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð¾Ð² Ð¾Ð´Ð½Ð¾ÐºÐ»Ð°ÑÑÐ¾Ð²Ð¾Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸, ÑÐ¾ ÐµÑÑÑ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð¸ÑÑÐ¾Ð´Ð¸Ñ ÑÐ¾Ð»ÑÐºÐ¾ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð½Ð¾ÑÐ¼Ð°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¿ÑÐ¾ÑÐµÑÑÐ¾Ð². Ð ÑÐ¾Ð´Ðµ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð¹ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ð¸ Ð´Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° Ð±ÑÐ»Ð° Ð¿Ð¾Ð´ÑÐ²ÐµÑÐ¶Ð´ÐµÐ½Ð° ÐµÐ³Ð¾ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ Ð² ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ ÑÑÐµÐ½Ð°ÑÐ¸ÑÑ. ÐÐ°Ð½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð¼Ð¾Ð¶ÐµÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ¾ÑÑ Ñ Ð¾Ð¿ÐµÑÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ð¾Ð¹ Windows.
description: The subject of the graduate qualification work is Â«Detection of advanced persistent threats based on the analysis of interaction graph of subjects and objects in the Windows operating systemÂ». The given work is devoted to studying of APT attacks and methods for APT detection. The goal of the work is to identify targeted attacks in Windows based on the analysis of interaction graphs of subjects and objects using machine learning. The thesis presents a study of existing methods for APT detection, highlights their advantages and disadvantages. As a result a method for detecting targeted attacks is proposed, the method is based on the idea of using a graph representation of the interaction of processes with system objects along with the use of machine learning. The distinguishing feature of this method is that the entire system interaction graph is never fully stored in memory. The second feature is the use of single-class classification algorithms, that is, learning occurs only with the help of data on the normal behavior of processes. During experimental testing of the software implementation of this method, its effectiveness was confirmed in various scenarios. This method can be used to detect targeted attacks on Windows hosts.