title: ÐÐ±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Computer attacks detectionbased on data mining of security events
Creators: name: Ð¨Ð°Ð¹Ð±ÑÐ»Ð°ÑÐ¾Ð², ÐÐ¸ÑÐ°Ð¸Ð»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÐµ Ð°ÑÐ°ÐºÐ¸
Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð·
Windows
SIEM
IRP
LSTM
computer attacks
data mining

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ°Ð±Ð¾ÑÐ¸Ðµ ÑÑÐ°Ð½ÑÐ¸Ð¸ Ð¿Ð¾Ð´ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸ÐµÐ¼ ÐÐ¡ ÑÐµÐ¼ÐµÐ¹ÑÑÐ²Ð° Windows. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð´Ð°Ð½Ð½ÑÑ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð²Ð¸Ð´Ð¾Ð² Ð¸ ÑÑÐ°Ð¿Ð¾Ð² Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº. 2. ÐÐ½Ð°Ð»Ð¸Ð· Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÑ Ð¸ÑÑÐ¾ÑÐ½Ð¸ÐºÐ¾Ð² Ð´Ð°Ð½Ð½ÑÑ, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÑ Ð¿ÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð·Ðµ. 3. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐµÐ¼ÑÑ Ð´Ð»Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿Ð¾Ð´ÑÐ¾Ð´Ð° Ðº Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ°Ð±Ð¾ÑÐ¸Ðµ ÑÑÐ°Ð½ÑÐ¸Ð¸ Ð¿Ð¾Ð´ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸ÐµÐ¼ ÐÐ¡ ÑÐµÐ¼ÐµÐ¹ÑÑÐ²Ð° Windows. 5. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÑÐ¸ÑÑÐµÐ¼Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Windows-Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð° Ð¸ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ðµ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¾ÑÐ½Ð¾ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°ÑÐ°Ðº. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ ÑÑÐ°Ð¿Ñ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº, Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½ÑÐµ Ð¸ÑÑÐ¾ÑÐ½Ð¸ÐºÐ¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð´Ð°Ð½Ð½ÑÑ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° ÑÐ¸ÑÑÐµÐ¼Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° ÑÐ°Ð±Ð¾ÑÐ¸Ðµ ÑÑÐ°Ð½ÑÐ¸Ð¸ Ð¿Ð¾Ð´ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸ÐµÐ¼ ÐÐ¡ ÑÐµÐ¼ÐµÐ¹ÑÑÐ²Ð° Windows Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÐµÐºÑÑÑÐµÐ½ÑÐ½Ð¾Ð¹ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½Ð¾Ð¹ ÑÐµÑÐ¸ LSTM. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Windows-Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¹.
description: The topic of the graduate qualification work is Â«Computer attacks detection based on data mining of security eventsÂ». The purpose of the study is to detect computer attacks on workstations running Windows OS, using data mining methods of security events. The subject of the work is modern methods of data mining. The research set the following goals: 1. Studying of types and ways of carrying out modern computer attacks. 2. Analysis of possible data sources used in the analysis of security events. 3. Studying of data mining methods of security events used to detect computer attacks. 4. Development of an approach to detecting computer attacks on workstations running Windows OS family. 5. Software implementation of a system for detecting computer attacks on Windows infrastructure based on the developed approach and conducting an experimental study of the accuracy of attack detection. During the work the stages of computer attacks and possible sources of security events were investigated. Modern data mining methods for detecting computer attacks were analyzed. The work resulted in development of a system for detecting computer attacks on workstations running Windows OS based on a recurrent neural network LSTM was developed. The results could be used as a basis for designing systems for detecting computer attacks on the Windows infrastructure of organizations.