title: Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½ÑÐµÑÐºÐ¾Ð¹ Ð°Ð½Ð°Ð»Ð¸ÑÐ¸ÐºÐ¸ Ð´Ð°Ð½Ð½ÑÑ SIEM Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Development of behavioral data analytics SIEM models for detecting cybersecurity incidents
Creators: name: ÐÐ¾ÑÐ¾ÑÐ¸Ð½, ÐÐ°ÑÐº
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2021
Subjects: Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÐµ ÑÐµÑÐ¸
Ð°Ð²ÑÐ¾ÐºÐ¾Ð´Ð¸ÑÐ¾Ð²ÑÐ¸Ðº
ÑÐµÐºÑÑÑÐµÐ½ÑÐ½ÑÐµ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÐµ ÑÐµÑÐ¸
Ð´Ð¾Ð»Ð³Ð°Ñ ÐºÑÐ°ÑÐºÐ¾ÑÑÐ¾ÑÐ½Ð°Ñ Ð¿Ð°Ð¼ÑÑÑ
Ð°ÑÐ´Ð¸Ñ ÑÐµÑÐ²Ð¸Ñ
ÑÐ±ÑÐ½ÑÐ°
ÐºÐ¾Ð¼Ð¿ÑÑÑÐµÑÐ½Ð°Ñ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÑ
Ð¿Ð¾Ð¸ÑÐº Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹
Ð¸Ð·Ð¾Ð»ÑÑÐ¸Ð¾Ð½Ð½ÑÐ¹Ð»ÐµÑ
Ð¾Ð´Ð½Ð¾ÐºÐ»Ð°ÑÑÐ¾Ð²ÑÐ¹ Ð¼ÐµÑÐ¾Ð´ Ð¾Ð¿Ð¾ÑÐ½ÑÑ Ð²ÐµÐºÑÐ¾ÑÐ¾Ð²
neural networks
autoencoder
recurrent neural network
lstm
audit
ubuntu
computer security
anomaly detection
isolation forest
one-class svm

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÑ Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð½ÐµÑÐ¸Ð¿Ð¸ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ, Ð²ÑÐ¿Ð¾Ð»Ð½ÑÑÑÐµÐ³Ð¾ ÑÐµÑÐ¼Ð¸Ð½Ð°Ð»ÑÐ½ÑÐµ ÐºÐ¾Ð¼Ð°Ð½Ð´Ñ Ð½Ð° ÑÐ´Ð°Ð»ÐµÐ½Ð½Ð¾Ð¼ ÑÐµÑÐ²ÐµÑÐµ. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ¸: 1. ÐÐ¾Ð´ÐµÐ»Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ð³Ð¾ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ° Ð¸ Ð°ÑÐ°ÐºÑÑÑÐµÐ¹ ÑÑÐ¾ÑÐ¾Ð½Ñ. 2. ÐÐ°ÑÑÑÐ¾Ð¹ÐºÐ° audit ÑÐµÑÐ²Ð¸ÑÐ° Ð´Ð»Ñ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð¸Ñ Ð»Ð¾Ð³Ð¾Ð² Ð¸ Ð¸Ñ Ð¿Ð¾ÑÐ»ÐµÐ´ÑÑÑÐµÐ³Ð¾ Ð¿ÑÐµÐ¾Ð±Â­ ÑÐ°Ð·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð´Ð°Ð½Ð½ÑÐµ. 3. ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð¸ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð´Ð»Ñ Ð·Ð°Ð´Ð°ÑÐ¸ Ð¿Ð¾Ð¸ÑÐºÐ° Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹. Ð ÑÐ°Ð±Ð¾ÑÐµ Ð±ÑÐ»Ð¸ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ñ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð´Ð»Ñ Ð¸Ð¼Ð¸ÑÐ°ÑÐ¸Ð¸ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ð½Ð¾Ð³Ð¾ Ð°Ð´Ð¼Ð¸Ð½Ð¸ÑÑÑÐ°ÑÐ¾ÑÐ° Ð¸ Ð°ÑÐ°ÐºÑÑÑÐµÐ¹ ÑÑÐ¾ÑÐ¾Ð½Ñ, Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð° ÐºÐ¾Ð½ÑÐ¸Ð³ÑÑÐ°ÑÐ¸Ñ audit ÑÐµÑÐ²Ð¸ÑÐ°, ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° Ð¼Ð°ÑÐµÐ¼Ð°ÑÐ¸ÑÐµÑÐºÐ°Ñ Ð¼Ð¾Ð´ÐµÐ»Ñ Ð´Ð°Ð½Ð½ÑÑ Ð¸ ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ñ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ñ Ð¸Ð·Ð¾Ð»ÑÑÐ¸Ð¾Ð½Â­Ð½Ð¾Ð³Ð¾ Ð»ÐµÑÐ°, Ð¾Ð´Ð½Ð¾ÐºÐ»Ð°ÑÑÐ¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð° Ð¾Ð¿Ð¾ÑÐ½ÑÑ Ð²ÐµÐºÑÐ¾ÑÐ¾Ð² Ð¸ Ð½ÐµÐ¹ÑÐ¾Ð½Ð½ÑÑ ÑÐµÑÐµÐ¹ Ð´Ð»Ñ Ð¿Ð¾Ð¸ÑÐºÐ° Ð½ÐµÑÐ¸Ð¿Ð¸ÑÐ½Ð¾Ð³Ð¾ Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð±ÑÐ» Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· ÑÐ°ÑÑÐ¼Ð¾ÑÑÐµÐ½Ð½ÑÑ Ð°Ð»Ð³Ð¾Â­ÑÐ¸ÑÐ¼Ð¾Ð², Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° Ð¾ÑÐµÐ½ÐºÐ° Ð²Ð¾Ð·Ð¼Ð¾Ð¶Ð½Ð¾ÑÑÐ¸ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ðº Ð´Ð°Ð½Ð½Ð¾Ð¹ Ð·Ð°Ð´Ð°ÑÐµ.
description: This program is designed to develop algorithms for detection anomaly userâs behavior, that execute terminal commands on the remote server. Tasks that were solved during development: 1. Modeling the behavior of the system administrator and the attacker. 2. Configuring the audit service to receive logs and then convert them into data. 3. Application and analysis of various machine learning methods for the problem of finding anomalies. The mathematical model of the data is developed. In this work, models were proposed to simulate the behavior of the system administrator and the attacker. The audit service configuration is proposed. The algorithms of the isolation forest, the one-class svm and neural networks for searching for anomaly user behavior are considered. As a result, comparative analysis of the considered algorithms was performed and the possibility of applying the methods to this problem is evaluated