title: ÐÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸Ðµ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² Ð³Ð»ÑÐ±Ð¾ÐºÐ¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ñ Ð¿Ð¾Ð´ÐºÑÐµÐ¿Ð»ÐµÐ½Ð¸ÐµÐ¼ Ð´Ð»Ñ ÑÐ°Ð½Ð½ÐµÐ³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Application of deep reinforcement learning methods for early detection of malicious user activity
Creators: name: ÐÐ´Ð°Ð½Ð¾Ð²Ð°, ÐÐ°ÑÑÑ
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2023
Subjects: ÐÐ°ÑÐ¸Ð½Ð½Ð¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ Ñ Ð¿Ð¾Ð´ÐºÑÐµÐ¿Ð»ÐµÐ½Ð¸ÐµÐ¼
Ð°Ð½Ð°Ð»Ð¸Ð· Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸
Ð¸Ð½ÑÐ°Ð¹Ð´ÐµÑ
Ð³Ð»ÑÐ±Ð¾ÐºÐ¾Ðµ Ð¾Ð±ÑÑÐµÐ½Ð¸Ðµ
Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÐ¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»Ñ
reinforcement learning
user activity analysis
insider
deep learning
malicious user

description: Ð¦ÐµÐ»Ñ Ð´Ð¸Ð¿Ð»Ð¾Ð¼Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÑ â ÑÐ¾ÐºÑÐ°ÑÐµÐ½Ð¸Ðµ Ð²ÑÐµÐ¼ÐµÐ½Ð¸ ÑÐµÐ°Ð³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ: 1. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°ÑÑ ÑÐ³ÑÐ¾Ð·Ñ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸, Ð¸ÑÑÐ¾Ð´ÑÑÐ¸Ðµ Ð¾Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÐµÐ¹, Ð¸ ÑÑÐµÐ½Ð°ÑÐ¸Ð¸ Ð°ÑÐ°Ðº, ÐºÐ¾ÑÐ¾ÑÑÐµ Ð¸Ñ ÑÐµÐ°Ð»Ð¸Ð·ÑÑÑ. 2. ÐÑÐ¾Ð°Ð½Ð°Ð»Ð¸Ð·Ð¸ÑÐ¾Ð²Ð°ÑÑ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¼ÐµÑÐ¾Ð´ ÑÐ°Ð½Ð½ÐµÐ³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð³Ð»ÑÐ±Ð¾ÐºÐ¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ñ Ð¿Ð¾Ð´ÐºÑÐµÐ¿Ð»ÐµÐ½Ð¸ÐµÐ¼. 4. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð¼ÐµÑÐ¾Ð´Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸, Ð¾ÑÐµÐ½Ð¸ÑÑ ÐºÐ°ÑÐµÑÑÐ²Ð¾ Ð¸ Ð·Ð°Ð´ÐµÑÐ¶ÐºÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ.Â Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ ÑÐ°Ð±Ð¾ÑÑ Ð¿ÑÐµÐ´Ð»Ð¾Ð¶ÐµÐ½ Ð¼ÐµÑÐ¾Ð´ ÑÐ°Ð½Ð½ÐµÐ³Ð¾ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð¹ Ð¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°ÑÐµÐ»ÑÑÐºÐ¾Ð¹ Ð°ÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸, Ð¾ÑÐ½Ð¾Ð²Ð°Ð½Ð½ÑÐ¹ Ð½Ð° ÑÑÐµÐ½Ð°ÑÐ½Ð¾Ð¼ Ð¿Ð¾Ð´ÑÐ¾Ð´Ðµ, Ñ Ð¿ÑÐ¸Ð¼ÐµÐ½ÐµÐ½Ð¸ÐµÐ¼ Ð³Ð»ÑÐ±Ð¾ÐºÐ¾Ð³Ð¾ Ð¾Ð±ÑÑÐµÐ½Ð¸Ñ Ñ Ð¿Ð¾Ð´ÐºÑÐµÐ¿Ð»ÐµÐ½Ð¸ÐµÐ¼. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½ÑÐ¹ Ð¿ÑÐ¾ÑÐ¾ÑÐ¸Ð¿ Ð¼ÐµÑÐ¾Ð´Ð° Ð¸ Ð¿ÑÐ¾Ð¸Ð·Ð²ÐµÐ´ÐµÐ½Ð° Ð¾ÑÐµÐ½ÐºÐ° ÐµÐ³Ð¾ ÑÐ°Ð±Ð¾ÑÑ: Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ðµ Ð¿ÑÐ¾Ð¸ÑÑÐ¾Ð´Ð¸Ñ Ñ ÑÐ¾ÑÐ½Ð¾ÑÑÑÑ 99,2%, Ð·Ð°ÑÑÐ°ÑÐµÐ½Ð½Ð¾Ðµ Ð²ÑÐµÐ¼Ñ Ð½Ð° Ð¾Ð±ÑÐ°Ð±Ð¾ÑÐºÑ Ð¾Ð´Ð½Ð¾Ð³Ð¾ ÑÐ¾Ð±ÑÑÐ¸Ñ â 0,013 Ñ Ð±ÐµÐ· Ð½ÐµÐ¾Ð±ÑÐ¾Ð´Ð¸Ð¼Ð¾ÑÑÐ¸ Ð°Ð³ÑÐµÐ³Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ ÑÐ¾Ð±ÑÑÐ¸Ð¹ Ð¿Ð¾ ÑÐµÐ°Ð½ÑÐ°Ð¼. ÐÐ¾Ð»ÑÑÐµÐ½Ð½ÑÐµ ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÑ Ð¼Ð¾Ð³ÑÑ Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ñ Ð´Ð»Ñ ÑÐ»ÑÑÑÐµÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼ Ð·Ð°ÑÐ¸ÑÑ Ð¾Ñ Ð²Ð½ÑÑÑÐµÐ½Ð½Ð¸Ñ ÑÐ³ÑÐ¾Ð· Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ Ð±ÐµÐ·Ð¾Ð¿Ð°ÑÐ½Ð¾ÑÑÐ¸.
description: The purpose of the thesis is to reduce the response time of malicious user activity detecting system. The research set the following goals: 1. Research of information security threats emanating from malicious users and attack scenarios that implement them. 2. Analysis of existing malicious user activity detection methods. 3. Development of a method for early detection of malicious user activity based on deep reinforcement learning. 4. Implementation of a software prototype of a method for detecting malicious user activity, evaluation of the quality and delay of detection.Â As a result of the work, the method of early detection of malicious user activity is proposed, based on a scenario approach, using deep reinforcement learning. A software prototype of the method was implemented, and its operation was evaluated: detection occurs with an accuracy of 99.2%, the time spent on processing one event is 0.013 seconds without the need for aggregation of events by user sessions. The results can be used to improve protection systems against internal information security threats.