title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð° Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¼ÐµÐ¶ÑÐµÑÐµÐ²ÑÑ ÑÐºÑÐ°Ð½Ð¾Ð² Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Development of a cyber range for analyzing the security of web application firewalls
Creators: name: Ð¡Ð²ÐµÑÐµÐ½ÐºÐ¾Ð², ÐÐ¸ÐºÐ¸ÑÐ°
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½
Ð¼ÐµÐ¶ÑÐµÑÐµÐ²Ð¾Ð¹ ÑÐºÑÐ°Ð½ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹
Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ
Ð°Ð½Ð°Ð»Ð¸Ð· Ð·Ð°ÑÐ¸ÑÑÐ½Ð½Ð¾ÑÑÐ¸
cyber range
web application firewall
automatization
security analysis

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ¸ Ð¼ÐµÐ¶ÑÐµÑÐµÐ²ÑÑ ÑÐºÑÐ°Ð½Ð¾Ð² Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¿ÑÐ¸ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ð¸ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð°. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ñ, Ð¿ÑÐµÐ´ÑÑÐ²Ð»ÑÐµÐ¼ÑÐµ Ðº Ð¼ÐµÐ¶ÑÐµÑÐµÐ²ÑÐ¼ ÑÐºÑÐ°Ð½Ð°Ð¼ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ð¸ Ð¿ÑÐ¸Ð½ÑÐ¸Ð¿Ñ ÑÐ°Ð·Ð²Ð¾ÑÐ°ÑÐ¸Ð²Ð°Ð½Ð¸Ñ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð¾Ð². ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ð¹ ÑÐ¾ÑÑÐ¸Ð¹ÑÐºÐ¸Ñ Ð¸ Ð¼ÐµÐ¶Ð´ÑÐ½Ð°ÑÐ¾Ð´Ð½ÑÑ ÑÐµÐ³ÑÐ»ÑÑÐ¾ÑÐ¾Ð² Ðº ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½ÑÑ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹. 2. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· Ð¾ÑÐµÑÐµÑÑÐ²ÐµÐ½Ð½ÑÑ Ð¸ Ð¸Ð½Ð¾ÑÑÑÐ°Ð½Ð½ÑÑ Ð¼ÐµÐ¶ÑÐµÑÐµÐ²ÑÐµ ÑÐºÑÐ°Ð½Ñ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹, Ð¾ÑÐµÐ½ÐºÑ Ð¸Ñ Ð¿ÑÐµÐ¸Ð¼ÑÑÐµÑÑÐ² Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¾Ð². 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¸ÐºÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð¹ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ¸ Ð¼ÐµÐ¶ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÐºÑÐ°Ð½Ð° Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹. 4. ÐÑÐ¾Ð²ÐµÑÑÐ¸ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÑ Ð¾ÑÐµÐ½ÐºÑ ÑÐ°Ð±Ð¾ÑÐ¾ÑÐ¿Ð¾ÑÐ¾Ð±Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð¹ Ð¼ÐµÑÐ¾Ð´Ð¸ÐºÐ¸ Ð½Ð° Ð±Ð°Ð·Ðµ Ð¼Ð¾Ð´ÐµÐ»Ð¸ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ ÑÑÐ¾ÑÐ¼ÑÐ»Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÐ°Ð¿Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½ÑÑ Ð²ÐµÐ±-ÑÐµÑÐ²Ð¸ÑÐ¾Ð², Ð¸ ÑÐ¸ÑÑÐµÐ¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÐµÐ±Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¿ÑÐµÐ´ÑÑÐ²Ð»ÑÐµÐ¼ÑÐµ Ðº ÑÐ¸ÑÑÐµÐ¼Ð°Ð¼ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð° Ð¸ Ð¼ÐµÐ¶ÑÐµÑÐµÐ²Ð¾Ð³Ð¾ ÑÐºÑÐ°Ð½Ð° Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½ Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÑÐ½Ð½Ð¾ÑÑÐ¸ Ð²ÐµÐ±-ÑÐµÑÑÑÑÐ° Ð¼ÐµÐ¶ÑÐµÑÐµÐ²ÑÐ¼ ÑÐºÑÐ°Ð½Ð¾Ð¼ Ð²ÐµÐ±-Ð¿ÑÐ¸Ð»Ð¾Ð¶ÐµÐ½Ð¸Ð¹ Ñ Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÑÑ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð¹ Ð½Ð°ÑÑÑÐ¾Ð¹ÐºÐ¸ WAF. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð¼Ð°ÑÑÑÐ°Ð±Ð½Ð¾Ð³Ð¾ ÐºÐ¸Ð±ÐµÑÐ¿Ð¾Ð»Ð¸Ð³Ð¾Ð½Ð°, Ð²ÐºÐ»ÑÑÐ°ÑÑÐµÐ³Ð¾ Ð² ÑÐµÐ±Ñ WAF.
description: The purpose of the work is to automate the deployment of web application firewalls within the framework of a cyber range. The subject of the research is the requirements for web application firewalls and the principles of deploying cyber testing sites. Tasks to be solved during the research: 1. To analyze the requirements of Russian and international regulators for the development of secure web applications. 2. To conduct a comparative analysis of domestic and foreign firewalls of web applications, an assessment of their advantages and disadvantages. 3. To develop a methodology for automated configuration of the firewall of web applications. 4. To conduct an experimental assessment of the efficiency of the developed methodology based on the cyber range model. In the course of the work, the stages of developing secure web services were formulated, and the security requirements for cyber range and web application firewall systems were systematized. As a result of the work, a cyber range was developed to analyze the security of a web resource by a web application firewall with the ability to automatically deploy WAF. The results obtained can be used as a basis for designing a large-scale cyber range, including WAF.