title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ°Ñ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detection of targeted attacks based on the analysis of anomalies in the parameters of the system functioning
Creators: name: ÐÐ°ÑÐ´Ð¸ÑÐ¾ÑÑÐ½, ÐÐ°Ð²ÐµÐ»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÐµ Ð°ÑÐ°ÐºÐ¸
Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹
behavioral analytics
targeted attacks
anomaly detection

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð¿ÑÑÐµÐ¼ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ°Ñ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹ Ð¸ ÑÑÑÐ½Ð¾ÑÑÐµÐ¹. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ·ÑÑÐµÐ½Ð¸Ðµ Ð¿ÑÐ¸Ð½ÑÐ¸Ð¿Ð¾Ð² Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐµÐ»ÐµÐ½Ð°Ð¿ÑÐ°Ð²Ð»ÐµÐ½Ð½ÑÑ Ð°ÑÐ°Ðº Ð¸ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÑ Ð´Ð»Ñ ÑÑÐ¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ² Ð¸ ÑÐ°ÐºÑÐ¸Ðº. 2. ÐÐ½Ð°Ð»Ð¸Ð· Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ¾Ð² ÑÐ¸ÑÑÐµÐ¼Ñ, Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³ ÐºÐ¾ÑÐ¾ÑÑÑ Ð¼Ð¾Ð¶ÐµÑ Ð¿Ð¾Ð·Ð²Ð¾Ð»Ð¸ÑÑ Ð²ÑÑÐ²Ð¸ÑÑ Ð¦Ð. 3. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¦Ð Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð¿Ð¾Ð¸ÑÐºÐ° Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ°Ñ ÑÐ¸ÑÑÐµÐ¼Ñ. 4. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð° ÑÑÐµÐ´ÑÑÐ²Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² ÑÐ¸ÑÑÐµÐ¼Ðµ, ÑÐ²ÑÐ·Ð°Ð½Ð½ÑÑ Ñ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸ÐµÐ¹ Ð¦Ð Ð°ÑÐ°ÐºÑÑÑÐ¸Ð¼Ð¸. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð° Ð°ÑÑÐ¸ÑÐµÐºÑÑÑÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÑÑÐµÐ´ÑÑÐ² Ð·Ð°ÑÐ¸ÑÑ, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÑ Ð½Ð° Ð¿Ð¾Ð¸ÑÐºÐµ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹. ÐÑÐ»Ð¸ Ð¿ÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ñ ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸ Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¾ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ð¸ ÑÐ¸ÑÑÐµÐ¼Ñ. ÐÑÐ» ÑÐ´ÐµÐ»Ð°Ð½ Ð²ÑÐ²Ð¾Ð´, ÑÑÐ¾ ÑÑÐµÐ´ÑÑÐ²Ð° Ð·Ð°ÑÐ¸ÑÑ Ð¾Ñ Ð¦Ð Ð½Ð°ÑÐ¾Ð´ÑÑÑÑ Ð½Ð° ÑÐ°Ð½Ð½ÐµÐ¼ ÑÑÐ°Ð¿Ðµ ÑÐ°Ð·Ð²Ð¸ÑÐ¸Ñ Ð¸ ÑÑÐµÐ±ÑÑÑ Ð¿Ð¾ÑÑÐ¾ÑÐ½Ð½Ð¾Ð³Ð¾ ÑÐ¾Ð²ÐµÑÑÐµÐ½ÑÑÐ²Ð¾Ð²Ð°Ð½Ð¸Ñ. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÑÐµÐ´ÑÑÐ² Ð·Ð°ÑÐ¸ÑÑ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¸ Ð¿ÑÐµÐ´Ð¿ÑÐ¸ÑÑÐ¸Ð¹ Ð¸ Ð¾ÑÐ³Ð°Ð½Ð¸Ð·Ð°ÑÐ¸Ð¹.
description: The purpose of the study is to identify APT by detecting anomalies in the parameters of the system functioning using behavioral analysis. The subject of the work is modern methods of behavioral analysis of users and entities. The research set the following goals: 1. Studying the principles of conducting advanced persistent threat and the means and tactics used for this. 2. Analysis of system parameters, the monitoring of which can reveal an APT. 3. Study of methods for detecting APT based on the search for anomalies in the system parameters. 4. Development of a prototype tool for detecting anomalies in the system related to the implementation of APT by attackers. During the work the architecture and implementation of modern protection tools based on the search for anomalies were studied. Modern studies in ensuring information security of organizations areas were analyzed. The work resulted in development of a tool for detecting anomalies in the functioning of the system. The studying point to conclusion that APT defenses are at an early stage of development and require continuous development. The results could be used as a base for designing custom mechanism of protecting information of enterprises and organizations.