title: ÐÑÑÐ²Ð»ÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÑÐ°ÑÐ¸ÐºÐ¾-Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Detection of malicious executable files based on static-dynamic analysis using machine learning
Creators: name: ÐÐ³Ð½ÐµÐ², Ð Ð¾Ð¼Ð°Ð½
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2021
Subjects: ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
ÐÑÑÐ¸ÑÐ»Ð¸ÑÐµÐ»ÑÐ½ÑÐµ Ð¼Ð°ÑÐ¸Ð½Ñ ÑÐ»ÐµÐºÑÑÐ¾Ð½Ð½ÑÐµ
ÐÑÐºÑÑÑÑÐ²ÐµÐ½Ð½ÑÐ¹ Ð¸Ð½ÑÐµÐ»Ð»ÐµÐºÑ
ÑÑÐ°ÑÐ¸ÐºÐ¾-Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¸Ð¹ Ð°Ð½Ð°Ð»Ð¸Ð·
static and dynamic analysis

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ (ÐÐÐ) Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ ÑÑÐ°ÑÐ¸ÐºÐ¾Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. Ð¦ÐµÐ»Ñ ÑÐ°Ð±Ð¾ÑÑ â Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ Ð·Ð° ÑÑÐµÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð¾Ð² Ð¼Ð°ÑÐ¸Ð½Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÑÐ°ÑÐ¸ÐºÐ¾Ð´Ð¸Ð½Ð°Ð¼Ð¸ÑÐµÑÐºÐ¾Ð³Ð¾ Ð°Ð½Ð°Ð»Ð¸Ð·Ð°. Ð Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐ¿Ð¾ÑÐ¾Ð±Ð¾Ð² Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ Ð¿ÑÐ¸ Ð¿Ð¾Ð¼Ð¾ÑÐ¸ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð°Ð½Ð¾Ð¼Ð°Ð»Ð¸Ð¹ Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ð¸ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð¸ Ð¾Ð¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ñ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ Ð¿ÑÐ¾Ð±Ð»ÐµÐ¼Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð². ÐÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¼ÐµÑÐ¾Ð´ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ, Ð² ÐºÐ¾ÑÐ¾ÑÐ¾Ð¼ Ð²ÑÐ¿Ð¾Ð»Ð½ÑÐµÑÑÑ Ð¾Ð¿ÑÐ¸Ð¼Ð¸Ð·Ð°ÑÐ¸Ñ ÐºÐ¾Ð»Ð¸ÑÐµÑÑÐ²Ð° Ð¿Ð°ÑÐ°Ð¼ÐµÑÑÐ¾Ð² Ð¿Ð¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð¿ÑÐ¸ Ð¿Ð¾Ð¼Ð¾ÑÐ¸ ÐºÐ»Ð°ÑÑÐµÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð½ÐµÐ·Ð½Ð°ÑÐ¸Ð¼ÑÑ Ð¿ÑÐ¸Ð·Ð½Ð°ÐºÐ¾Ð², Ð° ÑÐ°ÐºÐ¶Ðµ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÑÑÑ fuzzy-ÑÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ ÑÐ¾Ð±ÑÑÐ²ÐµÐ½Ð½ÑÑ ÑÑÐ½ÐºÑÐ¸Ð¹ Ð¿ÑÐ¸ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ð¸ ÑÑÐ°ÑÑÑ Ð²ÑÐ·Ð¾Ð²Ð¾Ð². Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ ÑÐ¸ÑÑÐµÐ¼Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ, Ð² Ð¾ÑÐ½Ð¾Ð²Ðµ ÐºÐ¾ÑÐ¾ÑÐ¾Ð³Ð¾ Ð»ÐµÐ¶Ð¸Ñ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½ÑÐ¹ Ð¼ÐµÑÐ¾Ð´. Ð­ÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¾Ð´ÐµÑÐ¶Ð°Ñ Ð¾ÑÐµÐ½ÐºÑ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½Ð½Ð¾Ð³Ð¾ Ð¼ÐµÑÐ¾Ð´Ð°. ÐÑÐµÐ½ÐµÐ½Ð° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¼ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿Ð¾Ð¼. Ð¡Ð¾Ð³Ð»Ð°ÑÐ½Ð¾ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ°Ð¼ Ð¿ÑÐ¾Ð²ÐµÑÐºÐ¸, ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ ÑÐ¼Ð¾Ð³ Ð¿Ð¾Ð²ÑÑÐ¸ÑÑ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÑ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ.
description: This work is devoted to the study of methods for detecting malicious software (malware) using static-dynamic analysis. The aim of this work is to increase the efficiency of malware detection by using machine learning algorithms based on staticdynamic analysis. The thesis presents a study of existing methods for detecting malware by detecting anomalies in the behavior of executable files and identifies the main problems of existing approaches. A method for detecting malware is proposed, which optimizes the number of behavior parameters of executable files by clustering insignificant features, and also uses fuzzy-hashing of its own functions when constructing a call trace. A prototype of a malware detection system was developed using the proposed method. Experimental studies assess the effectiveness of the proposed method. The efficiency of malware detection by the developed prototype is estimated. According to the verification results, the developed prototype was able to improve the detection efficiency of malware.