title: ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÑÐ¸ÑÑÐµÐ¼Ðµ ÑÐ¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð±Ð°Ð·Ð°Ð¼Ð¸ Ð´Ð°Ð½Ð½ÑÑ Ð¿ÑÑÐµÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð²
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Automation of the investigation of security incidents in the DBMS by developing a tool for analyzing log files
Creators: name: Ð®Ð½Ð³Ð°, ÐÐ°ÑÐ¸Ñ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2022
Subjects: ÑÐ¾ÑÐµÐ½Ð·Ð¸ÐºÐ° Ð¡Ð£ÐÐ
Ð¼Ð¾Ð´ÐµÐ»Ð¸
Ð°ÑÑÐµÑÐ°ÐºÑÑ
ÑÐµÐ»ÑÑÐ¸Ð¾Ð½Ð½ÑÐµ Ð¡Ð£ÐÐ
Ð¶ÑÑÐ½Ð°Ð» ÑÑÐ°Ð½Ð·Ð°ÐºÑÐ¸Ð¹
database forensics
forensic models
artifacts
relational SQL
transaction log

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² Ð¡Ð£ÐÐ Ð¿ÑÑÐµÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð²Â».Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¡Ð£ÐÐ Ð¿ÑÑÐµÐ¼ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð². Â ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÐµÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð² Ð´Ð»Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸.Â  ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ:ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼Ð¾Ð´ÐµÐ»Ð¸ ÑÐ¾ÑÐµÐ½Ð·Ð¸ÐºÐ¸ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¡Ð£ÐÐ, ÑÑÐ¾Ð±Ñ Ð²ÑÑÐ²Ð¸ÑÑ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ ÑÑÐ°Ð¿Ñ Ð¾Ð±Ð¾Ð±ÑÐµÐ½Ð½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»Ð¸.ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð°ÑÑÐµÑÐ°ÐºÑÑ ÑÐ¾ÑÐµÐ½Ð·Ð¸ÐºÐ¸ Ð² Ð¡Ð£ÐÐ.ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ Ð¶ÑÑÐ½Ð°Ð»Ñ ÑÑÐ°Ð½Ð·Ð°ÐºÑÐ¸Ð¹ Ð² ÑÐµÐ»ÑÑÐ¸Ð¾Ð½Ð½ÑÑ Ð¡Ð£ÐÐ ÐºÐ°Ðº Ð¸ÑÑÐ¾ÑÐ½Ð¸Ðº Ð°ÑÑÐµÑÐ°ÐºÑÐ¾Ð² Ð´Ð»Ñ ÑÐ¾ÑÐµÐ½Ð·Ð¸ÐºÐ¸.Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¸ Ð¿ÑÐ¾ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°ÑÑ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð² ÑÑÐ°Ð½Ð·Ð°ÐºÑÐ¸Ð¹.Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ Ð¼Ð¾Ð´ÐµÐ»Ð¸ ÑÐ¾ÑÐµÐ½Ð·Ð¸ÐºÐ¸ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¡Ð£ÐÐ, ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ Ð°ÑÑÐµÑÐ°ÐºÑÑ, Ð¿ÑÐµÐ´Ð½Ð°Ð·Ð½Ð°ÑÐµÐ½Ð½ÑÐµ Ð´Ð»Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² Ð¡Ð£ÐÐ. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ°Ð¹Ð»Ñ Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð² Ð´Ð»Ñ ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ ÑÐµÐ»ÑÑÐ¸Ð¾Ð½Ð½ÑÑ Ð¡Ð£ÐÐ.Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð° Ð¾Ð±Ð¾Ð±ÑÐµÐ½Ð½Ð°Ñ Ð¼Ð¾Ð´ÐµÐ»Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¡Ð£ÐÐ, Ð²ÑÐ´ÐµÐ»ÐµÐ½Ñ Ð°ÑÑÐµÑÐ°ÐºÑÑ Ð´Ð»Ñ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¡Ð£ÐÐ, Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¾ Â«Ð´ÐµÑÐµÐ²Ð¾Â» Ð°ÑÑÐµÑÐ°ÐºÑÐ¾Ð², Ð²ÑÑÐ²Ð»ÐµÐ½Ñ Ð¾ÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð² ÑÑÐ°Ð½Ð·Ð°ÐºÑÐ¸Ð¹ Ð¿ÑÐ¾Ð¼ÑÑÐ»ÐµÐ½Ð½ÑÑ Ð¡Ð£ÐÐ, ÐºÐ°Ðº Ð¸ÑÑÐ¾ÑÐ½Ð¸Ðº Ð´Ð°Ð½Ð½ÑÑ Ð¾Ð± Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ°Ñ.Ð¢Ð°ÐºÐ¸Ð¼ Ð¾Ð±ÑÐ°Ð·Ð¾Ð¼, Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¶ÑÑÐ½Ð°Ð»Ð¾Ð² ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ ÑÐµÐ»ÑÑÐ¸Ð¾Ð½Ð½ÑÑ Ð¡Ð£ÐÐ.ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¸Ð½ÑÑÑÑÐ¼ÐµÐ½ÑÐ° ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² Ð¡Ð£ÐÐ.
description: The topic of the graduate qualification work is Â«Automation of the investigation of security incidents in the DBMS by developing a tool for analyzing log filesÂ».The purpose of the study is automation of the investigation of security incidents in the DBMS by developing a tool for analyzing log files. The subject of the work is the use of log files to investigate traces of malicious activities. The research set the following goals:Analyze the existing forensic models in DBMS in order to identify the main stages of the generalized model.Analyze database artifacts in forensics.Analyze transaction logs of relational DBMS as a source of artifacts for forensics. Also log filesDevelop and test a software tool for analyzing transaction logs.During the work the forensic models and artifacts in DBMS were studied. Also log files of various relational DBMS were analyzed.The work resulted in the proposed common model of database forensic investigation process, the artifacts identified for investigating DBMS incidents, development of artifacts Â«treeÂ», identification of characteristic of log files in relational database. A software tool, therefore, was developed to analyze logs files of various relational DBMS to investigate traces of malicious activities in database.The results could be used a tool with which an expert can use the necessary information in the log files to detect and analyze security incidents in the database.