title: ÐÑÐ¾Ð±ÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð¿Ð¾ÑÑÐ¾ÑÐ¾Ð½Ð½ÐµÐ³Ð¾ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»Ð° Ð² ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð°Ñ
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° ÑÐ¿ÐµÑÐ¸Ð°Ð»Ð¸ÑÑÐ°
titleType: Subtitle
title: Features of detection of extraneous functionality in the installation files
Creators: name: Ð®Ð³Ð°Ð¹, ÐÐ°Ð²ÐµÐ»
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2020
Subjects: ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÐµ ÑÐ¸ÑÑÐµÐ¼Ñ
ÐÐ½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ñ
ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÐµ ÑÐ°Ð¹Ð»Ñ
ÑÑÐ¾ÑÐ½ÑÐºÐ¸Ð¹ ÑÑÑÐ°Ð½Ð¾Ð²ÑÐ¸Ðº
ÑÑÐ¾ÑÐ½ÑÐºÐ¸Ð¹ Ð·Ð°Ð³ÑÑÐ·ÑÐ¸Ðº
Ð½Ð°Ð¸Ð²Ð½ÑÐ¹ Ð±Ð°Ð¹ÐµÑÐ¾Ð²ÑÐºÐ¸Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¾Ñ
Ð´ÐµÑÐµÐ²Ð¾ Ð¿ÑÐ¸Ð½ÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹
ÑÐ»ÑÑÐ°Ð¹Ð½ÑÐ¹ Ð»ÐµÑ
installation files
troyan dropper
troyan downloader
naive bayesian classifier
decision tree
random forest

description: ÐÐ°Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð¿Ð¾ÑÐ²ÑÑÐµÐ½Ð° Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ Ð¸ Ð´ÑÑÐ³Ð¾Ð³Ð¾ Ð¿Ð¾ÑÑÐ¾ÑÐ¾Ð½Ð½ÐµÐ³Ð¾ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»Ð° Ð² ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð°Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÐºÐ¾ÑÐ¾ÑÑÐµ ÑÐµÑÐ°Ð»Ð¸ÑÑ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÐ·ÑÑÐµÐ½Ð¸Ðµ ÑÑÑÑÐºÑÑÑÑ Ð¸ ÑÐ²Ð¾Ð¹ÑÑÐ² ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð¸ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ. 2. Ð¤Ð¾ÑÐ¼Ð¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð²ÑÐ±Ð¾ÑÐºÐ¸ Ð»ÐµÐ³Ð¸ÑÐ¸Ð¼Ð½ÑÑ ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð², ÑÑÑÐ°Ð½Ð¾Ð²ÑÐ¸ÐºÐ¾Ð² Ñ Ð¿Ð¾ÑÑÐ¾ÑÐ¾Ð½Ð½Ð¸Ð¼ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»Ð¾Ð¼ Ð¸ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼. 3. ÐÐ½Ð°Ð»Ð¸Ð· Ð¿ÑÐ¸Ð¼ÐµÐ½Ð¸Ð¼Ð¾ÑÑÐ¸ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÑÐµÐ´ÑÑÐ² Ð¾Ð±Ð½Ð°ÑÑÐ¶ÐµÐ½Ð¸Ñ ÐÐÐ Ðº ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÐ¼ ÑÐ°Ð¹Ð»Ð°Ð¼. 4. ÐÐ¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ð¸Ðµ Ð½Ð°Ð¸Ð±Ð¾Ð»ÐµÐµ Ð²Ð°Ð¶Ð½ÑÑ ÐºÑÐ¸ÑÐµÑÐ¸ÐµÐ² Ð´Ð»Ñ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ð½Ð° Ð»ÐµÐ³Ð¸ÑÐ¸Ð¼Ð½ÑÐµ Ð¸ Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½ÑÐµ. 5. ÐÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸ Ð´Ð»Ñ ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð² Ñ Ð¿Ð¾ÑÑÐ¾ÑÐ¾Ð½Ð½Ð¸Ð¼ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»Ð¾Ð¼. Ð Ð½Ð°ÑÑÐ¾ÑÑÐµÐ¹ Ð²ÑÐ¿ÑÑÐºÐ½Ð¾Ð¹ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ°Ð±Ð¾ÑÐµ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¾ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ ÑÑÑÐ°Ð½Ð¾Ð²Ð¾ÑÐ½ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð², Ð²ÑÐµÐ´Ð¾Ð½Ð¾ÑÐ½Ð¾Ð³Ð¾ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ Ð¾Ð±ÐµÑÐ¿ÐµÑÐµÐ½Ð¸Ñ, Ð° Ð¸Ð¼ÐµÐ½Ð½Ð¾ ÑÑÐ¾ÑÐ½ÑÐºÐ¸Ñ ÑÑÑÐ°Ð½Ð¾Ð²ÑÐ¸ÐºÐ¾Ð² Ð¸ Ð·Ð°Ð³ÑÑÐ·ÑÐ¸ÐºÐ¾Ð², Ð¸ ÑÑÑÐ°Ð½Ð¾Ð²ÑÐ¸ÐºÐ¾Ð² Ñ Ð¿Ð¾ÑÑÐ¾ÑÐ¾Ð½Ð½Ð¸Ð¼ ÑÑÐ½ÐºÑÐ¸Ð¾Ð½Ð°Ð»Ð¾Ð¼. ÐÑÐ¸Ð²ÐµÐ´ÑÐ½ ÑÑÐ°Ð²Ð½Ð¸ÑÐµÐ»ÑÐ½ÑÐ¹ Ð°Ð½Ð°Ð»Ð¸Ð· Ð½ÐµÐºÐ¾ÑÐ¾ÑÑÑ Ð¼ÐµÑÐ¾Ð´Ð¾Ð² ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¸: Ð½Ð°Ð¸Ð²Ð½ÑÐ¹ Ð±Ð°Ð¹ÐµÑÐ¾Ð²ÑÐºÐ¸Ð¹ ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¾Ñ, ÑÐ»ÑÑÐ°Ð¹Ð½ÑÐ¹ Ð»ÐµÑ Ð¸ Ð°Ð»Ð³Ð¾ÑÐ¸ÑÐ¼ C. 45. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°Ð½Ð° Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð°, ÐºÐ¾ÑÐ¾ÑÐ°Ñ Ð¾ÑÑÑÐµÑÑÐ²Ð»ÑÐµÑ Ð¸Ð·Ð²Ð»ÐµÑÐµÐ½Ð¸Ðµ Ð°ÑÑÐ¸Ð±ÑÑÐ¾Ð² Ð¸Ð· Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð². ÐÑÑÑÐµÑÑÐ²Ð»ÐµÐ½Ð° ÐºÐ»Ð°ÑÑÐ¸ÑÐ¸ÐºÐ°ÑÐ¸Ñ Ñ Ð¿Ð¾Ð¼Ð¾ÑÑÑ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼Ð½Ð¾Ð³Ð¾ ÑÑÐµÐ´ÑÑÐ²Ð° Weka Ð² ÑÐ¾Ð¾ÑÐ²ÐµÑÑÑÐ²Ð¸Ð¸ Ñ ÑÐ°ÑÑÐ¼Ð°ÑÑÐ¸Ð²Ð°ÐµÐ¼ÑÐ¼Ð¸ Ð¼ÐµÑÐ¾Ð´Ð°Ð¼Ð¸. ÐÐ¿ÑÐµÐ´ÐµÐ»ÐµÐ½Ñ Ð·Ð½Ð°ÑÐ¸Ð¼ÑÐµ Ð°ÑÑÐ¸Ð±ÑÑÑ Ð¸ÑÐ¿Ð¾Ð»Ð½ÑÐµÐ¼ÑÑ ÑÐ°Ð¹Ð»Ð¾Ð², ÐºÐ¾ÑÐ¾ÑÑÐµ Ð½Ð°Ð¸Ð±Ð¾Ð»ÐµÐµ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ Ð¾ÑÐ»Ð¸ÑÐ°ÑÑ Ð»ÐµÐ³Ð¸ÑÐ¸Ð¼Ð½ÑÐµ ÑÑÑÐ°Ð½Ð¾Ð²ÑÐ¸ÐºÐ¸ Ð¾Ñ ÑÑÐ¾ÑÐ½ÑÐºÐ¸Ñ Ð¿ÑÐ¾Ð³ÑÐ°Ð¼Ð¼.
description: The given work is devoted to the detection of malicious software and other extraneous functionality in the installation files. The research set the following goals: 1. The study of the structure and properties of the installation files and malware. 2. Formation of a selection of legitimate installation files, installers with extraneous functionality and malware. 3. An analysis of the applicability of existing malware detection tools to installation files. 4. Determining the most important criteria for classifying installation files as legitimate and malicious. 5. A study of the effectiveness of classification methods for installation files with extraneous functionality. This graduate qualification work presents a study of installation files, malware, specifically Trojan droppers and downloaders, and installers with extraneous functionality. A comparative analysis of some classification methods is presented: the Naive Bayes classifier, the Random forest and the C. 45 algorithm. A program has been implemented that extracts attributes from executable files. The classification was carried out using the Weka software in accordance with the methods under consideration. Significant attributes of PE-files are identified that most effectively distinguish legitimate installers from trojans.