title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Identification of information security incidents in computer systems based on the intelligent analysis of system events
Creators: name: Ð¥Ð¾Ð·ÑÐ¸Ð½Ð¾Ð², ÐÐ½Ð´ÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
Ð¸Ð½ÑÐ¸Ð´ÐµÐ½Ñ ÐÐ
ÐºÐ»Ð°ÑÑÐµÑÐ¸Ð·Ð°ÑÐ¸Ñ
ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ
ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ðµ ÑÐ¾Ð±ÑÑÐ¸Ðµ
information security
is incident
clustering
classification
system event

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ ÑÐµÑÐ°Ð»Ð¸ÑÑ ÑÐ»ÐµÐ´ÑÑÑÐ¸Ðµ Ð·Ð°Ð´Ð°ÑÐ¸: 1. ÐÐ½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¸ ÑÑÐµÐ´ÑÑÐ² Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ 2. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¶ÑÑÐ½Ð°Ð»Ð°Ñ ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼ÐµÑÐ¾Ð´Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð¿ÑÐµÐ´Ð²Ð°ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾ Ð²ÑÐ´ÐµÐ»ÐµÐ½Ð½ÑÑ ÐºÐ»Ð°ÑÑÐµÑÐ¾Ð² ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð° ÑÐ¸ÑÑÐµÐ¼Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð² ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑÑÐ°Ð»ÑÐ½Ð¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð¿Ð¾ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸ÑÑ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. Ð¢Ð°ÐºÐ¶Ðµ Ð±ÑÐ» ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¼ÐµÑÐ¾Ð´ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð½Ð° ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð¿ÑÐµÐ´Ð²Ð°ÑÐ¸ÑÐµÐ»ÑÐ½Ð¾ Ð²ÑÐ´ÐµÐ»ÐµÐ½Ð½ÑÑ ÐºÐ»Ð°ÑÑÐµÑÐ¾Ð² ÑÐ¸ÑÑÐµÐ¼Ð½ÑÑ ÑÐ¾Ð±ÑÑÐ¸Ð¹. ÐÑÐ» Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ ÑÐ¸ÑÑÐµÐ¼Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð². Ð ÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¼Ð¾Ð¶Ð½Ð¾ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÑ Ð´Ð»Ñ Ð´Ð°Ð»ÑÐ½ÐµÐ¹ÑÐ¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ¾Ðº Ð² ÑÑÐ¾Ð¼ Ð½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð¸Ð¸.
description: The given work is devoted to revealing of incidents of information safety in computer systems. During work the following tasks were solved: 1. The analysis of existing methods and means of revealing of incidents of information safety in computer systems. 2. Study of existing methods for detecting anomalies in the system event logs. 3. Development of a method of revealing of incidents of information safety in computer systems on the basis of classification of preliminary allocated clusters of system events. 4. Working out of a prototype of system of revealing of incidents of information safety in computer systems on the basis of the intellectual analysis of system events. As a result, the existing work on the identification of anomalies in system events using machine learning algorithms were analyzed. Also the method of revealing of incidents of information safety, based on classification of preliminary allocated clusters of system events has been developed. The prototype of system of revealing of incidents has been offered. Results of research can be used for further development in this direction.