title: ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð´Ð»Ñ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ ÑÐµÐ¿Ð¾Ð·Ð¸ÑÐ¾ÑÐ¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸ÐµÐ² Ð°ÑÐ°Ðº Ð½Ð° ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½ÑÑ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¼Ð°Ð³Ð¸ÑÑÑÐ°
titleType: Subtitle
title: Research and development of an algorithm based on large language models to create a repository of attack scenarios on corporate infrastructure
Creators: name: Ð¢ÑÐ³Ð°Ð¹, ÐÐ½Ð´ÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð±Ð¾Ð»ÑÑÐ¸Ðµ ÑÐ·ÑÐºÐ¾Ð²ÑÐµ Ð¼Ð¾Ð´ÐµÐ»Ð¸
ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð½Ð° Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÑ
ÑÐ¸Ð¿Ð¸Ð·Ð°ÑÐ¸Ñ Ð°ÑÐ°Ðº
ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½ÑÐµ ÑÐµÑÐ¸
large language models
incident response
attack typing
corporate networks

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð´Ð»Ñ ÑÐ¸Ð¿Ð¸Ð·Ð°ÑÐ¸Ð¸ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ° Ð² ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½Ð¾Ð¹ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÐµ Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸ÐµÐ¼ Ð±Ð¾Ð»ÑÑÐ¸Ñ ÑÐ·ÑÐºÐ¾Ð²ÑÑ Ð¼Ð¾Ð´ÐµÐ»ÐµÐ¹ Ð¸ ÑÐ¾ÑÑÐ°Ð½ÐµÐ½Ð¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸Ñ Ð°ÑÐ°ÐºÐ¸ Ð² Ð½Ð°Ð³Ð»ÑÐ´Ð½Ð¾Ð¼ Ð¸ Ð¿ÑÐ¸Ð³Ð¾Ð´Ð½Ð¾Ð¼ Ð´Ð»Ñ ÑÐ°ÑÐ¿ÑÐ¾ÑÑÑÐ°Ð½ÐµÐ½Ð¸Ñ Ð²Ð¸Ð´Ðµ. ÐÑÐµÐ´Ð¼ÐµÑÐ¾Ð¼ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ²Ð»ÑÑÑÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ ÑÐµÐ¿Ð¾Ð·Ð¸ÑÐ¾ÑÐ¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸ÐµÐ² Ð°ÑÐ°Ðº Ð½Ð° ÐºÐ¾ÑÐ¿Ð¾ÑÐ°ÑÐ¸Ð²Ð½ÑÑ Ð¸Ð½ÑÑÐ°ÑÑÑÑÐºÑÑÑÑ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: - ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐ¿Ð¾ÑÐ¾Ð±Ð¾Ð² Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸ÐµÐ² Ð°ÑÐ°Ðº Ð¸ Ð¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð² ÐºÐ¸Ð±ÐµÑÐ±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸; - ÐÐ±Ð·Ð¾Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½Ð¾Ð³Ð¾ Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸ÐµÐ² Ð°ÑÐ°Ðº Ð¸Ð· Ð´Ð°Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ð°; - Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐºÐ° Ð¸ ÑÐµÐ°Ð»Ð¸Ð·Ð°ÑÐ¸Ñ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸ÑÐµÑÐºÐ¾Ð³Ð¾ ÑÐ¾Ð·Ð´Ð°Ð½Ð¸Ñ ÑÑÐµÐ½Ð°ÑÐ¸Ñ Ð°ÑÐ°ÐºÐ¸ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÐ¾Ð¿Ð¾ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¾Ð¿Ð¾Ð²ÐµÑÐµÐ½Ð¸Ð¹ ÑÐ¸ÑÑÐµÐ¼ Ð¼Ð¾Ð½Ð¸ÑÐ¾ÑÐ¸Ð½Ð³Ð° Ñ Ð¾Ð¿Ð¸ÑÐ°Ð½Ð¸ÐµÐ¼ ÑÐµÑÐ½Ð¸Ðº Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ°; - Ð­ÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÐµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð°. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð»Ð¸ÑÑ ÑÐ°ÐºÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ, ÐºÐ°Ðº Ð°Ð½Ð°Ð»Ð¸Ð· Ð¸ Ð¼Ð¾Ð´ÐµÐ»Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ, Ð¿ÑÐ¸Ð¼ÐµÐ½ÑÐ²ÑÐ¸ÐµÑÑ Ð¿ÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐºÐµ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð° Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ¸Ð¿Ð¸Ð·Ð°ÑÐ¸Ð¸ Ð´ÐµÐ¹ÑÑÐ²Ð¸Ð¹ Ð·Ð»Ð¾ÑÐ¼ÑÑÐ»ÐµÐ½Ð½Ð¸ÐºÐ° Ð² Ð°ÑÐ°ÐºÑÐµÐ¼Ð¾Ð¹ ÑÐµÑÐ¸. ÐÐ¾ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐ°Ð¼ ÑÐºÑÐ¿ÐµÑÐ¸Ð¼ÐµÐ½ÑÐ°Ð»ÑÐ½ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹ Ð±ÑÐ»Ð° Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð° Ð¾ÑÐµÐ½ÐºÐ° ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð³Ð¾ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼Ð°. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð² ÐºÐ°ÑÐµÑÑÐ²Ðµ Ð¾ÑÐ½Ð¾Ð²Ñ Ð´Ð»Ñ Ð¿ÑÐ¾ÐµÐºÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ ÑÐ°ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ð¹ ÐºÐ¸Ð±ÐµÑÐ¸Ð½ÑÐ¸Ð´ÐµÐ½ÑÐ¾Ð².
description: The purpose of the work is to develop an algorithm to typify the actions of an attacker in the corporate infrastructure using large language models and save the attack scenario in a visual and suitable for distribution. The subject of the research is an algorithm for creating a repository of attack scenarios for corporate infrastructure. The tasks to be solved during the research are: - Survey of existing methods for describing attack scenarios and cybersecurity incidents. - Review of existing methods for automated extraction of attack scenarios from monitoring system data. - Development and implementation of an algorithm for automated attack scenario creation based on matching monitoring system alerts with the description of attackers techniques. - Experimental studies of the developed algorithm. In the course of the work, we used such research methods as analysis and modeling used in the development of the algorithm for automating the typing of the attackers actions in the attacked network. Based on the results of experimental research, the effectiveness of the developed algorithm was evaluated. The results obtained can be used as a basis for designing systems for automating cyber incident investigation.