title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐµÐ´ÑÐºÐ°Ð·Ð°ÑÐµÐ»ÑÐ½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð² SIEM-ÑÐ¸ÑÑÐµÐ¼Ð°Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Development of a predictive model for prioritizing incidents in SIEM systems
Creators: name: ÐÐµÐ´Ð¾Ð², ÐÐ¸ÐºÐ¸ÑÐ°
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2025
Subjects: Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð²
siem-ÑÐ¸ÑÑÐµÐ¼Ð°
Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
mitre att&amp;ck
kill chain
kuma
incident prioritization
siem system
machine learning

description: Ð¢ÐµÐ¼Ð° Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ: Â«Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐµÐ´ÑÐºÐ°Ð·Ð°ÑÐµÐ»ÑÐ½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð² SIEM-ÑÐ¸ÑÑÐµÐ¼Ð°ÑÂ». Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð° ÑÐ¸ÑÑÐµÐ¼Ñ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð² SIEM-ÑÐ¸ÑÑÐµÐ¼Ð°Ñ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð°Ñ Ð¿ÑÐµÐ´ÑÐºÐ°Ð·Ð°ÑÐµÐ»ÑÐ½Ð°Ñ Ð¼Ð¾Ð´ÐµÐ»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð² SIEM-ÑÐ¸ÑÑÐµÐ¼Ð°Ñ Ð½Ð° Ð¿ÑÐ¸Ð¼ÐµÑÐµ SIEM KUMA. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸ ÑÑÐµÐ¹Ð¼Ð²Ð¾ÑÐºÐ¾Ð² Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÐºÐ¸Ð±ÐµÑÐ°ÑÐ°Ðº. 2. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¼ÐµÑÐ¾Ð´ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ. 4. ÐÑÐµÐ½Ð¸ÑÑ ÑÐ¾ÑÐ½Ð¾ÑÑÑ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. Ð Ð¿ÑÐ¾ÑÐµÑÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ» Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ¾Ð²ÑÐµÐ¼ÐµÐ½Ð½ÑÑ ÑÐµÑÐµÐ½Ð¸Ð¹ Ð² Ð¾Ð±Ð»Ð°ÑÑÐ¸ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð², Ð° ÑÐ°ÐºÐ¶Ðµ ÑÐ¾Ð±ÑÐ°Ð½ Ð¸ Ð¿Ð¾Ð´Ð³Ð¾ÑÐ¾Ð²Ð»ÐµÐ½ Ð´Ð°ÑÐ°ÑÐµÑ Ð¸Ð· ÑÐµÐ°Ð»ÑÐ½ÑÑ Ð´Ð°Ð½Ð½ÑÑ, ÑÐ¾Ð´ÐµÑÐ¶Ð°ÑÐ¸Ñ Ð»Ð¾Ð³Ð¸ ÑÐ¾Ð±ÑÑÐ¸Ð¹. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° Ð¼Ð¾Ð´ÐµÐ»Ñ, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÑÑÐ°Ñ Ð¼ÐµÑÐ¾Ð´Ñ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð², ÑÑÐ¸ÑÑÐ²Ð°Ñ Ð¸Ñ ÐºÐ¾Ð½ÑÐµÐºÑÑ Ð¸ Ð²Ð·Ð°Ð¸Ð¼Ð¾ÑÐ²ÑÐ·Ð¸ Ð² ÑÐ°Ð¼ÐºÐ°Ñ ÑÐµÐ¿Ð¾ÑÐºÐ¸ ÐºÐ¸Ð±ÐµÑÐ°ÑÐ°ÐºÐ¸ (Kill Chain). ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¿ÑÐ¸Ð¾ÑÐ¸ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² Ð² SIEM ÑÐ¸ÑÑÐµÐ¼Ð°Ñ.
description: The topic of the graduate qualification work is Â«Development of a predictive model for prioritizing incidents in SIEM systems.Â». The purpose of the study is to develop a prototype of an incident prioritization system using machine learning models in SIEM systems. The subject of the work is the developed predictive automation model prioritization of incidents in SIEM systems using the example of SIEM KUMA. The research set the following goals: 1. Conduct an analysis of existing prioritization methods and frameworks for cyberattack analysis. 2. Develop a prioritization method utilizing machine learning models. 3. Design a prototype of an incident prioritization system based on machine learning models. 4. Evaluate the accuracy of the proposed prioritization method. During the work an analysis of modern solutions in the field of incident prioritization was performed, as well as a dataset was collected and prepared from real data containing event logs. As a result of the research, a model was developed that uses machine learning methods to classify incidents, considering their context and interrelationships within the cyberattack chain (Kill Chain). The results could be used as a base for building an incident prioritization system in SIEM systems.