vdgtuВестник Дагестанского государственного технического университета. Технические наукиHerald of Dagestan State Technical University. Technical Sciences2073-61852542-095XDaghestan State Technical University10.21822/2073-6185-2023-50-4-93-100vdgtu-1396Research ArticleИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИ И ТЕЛЕКОММУНИКАЦИИINFORMATION TECHNOLOGY AND TELECOMMUNICATIONSРазработка методов нейтрализации угроз «нулевого дня»Development of methods for neutralizing «Zero-day» threatsДубровинаА. И.DubrovinaA. I.

Дубровина Ангелина Игоревна - ассистент, кафедра «Вычислительные системы и информационная безопасность».

344000, Ростов-на-Дону, пл. Гагарина, 1; 2344000, Ростов-на-Дону, ул. Мечникова, 130

Angelina I. Dubrovina - Assistant, Department of Computer Systems and Information Security.

1 Gagarin Square, Rostov-on-Don 344000; 130 Mechnikova St., Rostov-on-Don 344000

adubrovina@yug.gkovd.ruАлкордиМ. Х.AlcordiM. H.

Алкорди Мустафа Хельми Муса - студент, кафедра «Вычислительные системы и информационная безопасность».

344000, Ростов-на-Дону, пл. Гагарина, 1

Mustafa H. Alcordi - Student, Department of Computer Systems and Information Security.

1 Gagarin Square, Rostov-on-Don 344000

ministrelia69@yandex.ruДонской государственный технический университет; Частное образовательное учреждение высшего образования «Южный университет» (Институт управления, бизнеса и права)РоссияDon State Technical University; Southern University (Institute of Management, Business and Law)Russian FederationДонской государственный технический университетРоссияDon State Technical UniversityRussian Federation20232201202450493100Copyright © Дубровина А.И., Алкорди М.Х., 20242024Дубровина А.И., Алкорди М.Х.Dubrovina A.I., Alcordi M.H.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.dgtu.ru/jour/article/view/1396

Цель. Целью данного исследования является разработка и анализ методов нейтрализации угроз «нулевого дня» с целью повышения уровня кибербезопасности и защиты информационных систем. Метод. В настоящей статье использован поведенческий анализ угрозы. Изучены характерные признаки поведения эксплойта «нулевого дня». Модель угрозы основана на решении задач по своевременному обнаружению и нейтрализации угрозы. Результат. Рассмотрена актуальная проблема безопасности информационных систем - угроза «нулевого дня». Проведены обзор существующих методов нейтрализации и обсуждение эффективных новых подходов. Выявлено, что основным уязвимым местом являются устаревшие сигнатуры угроз. Обнаружение угроз основано на исследовании поведения программных обеспечений – сравнение с предыдущим днем, отслеживание возможно преимущественно засчет анализа log-файлов, снятых с автоматизированного рабочего места. Вывод. Доказана важность разработки методов нейтрализации угроз «нулевого дня» во избежание централизованного распространения уязвимости и заражения большого числа автоматизированных рабочих мест, что может привести к приостановке производственных процессов в рамках большого предприятия.

Objective. The purpose of this study is to develop and analyze methods for neutralizing «zero-day» threats in order to increase the level of cybersecurity and protection of information systems. Method. In this article, a behavioral analysis of the threat is used. The characteristic features of the zero-day exploit behavior have been studied. The threat model is based on solving the tasks of timely detection and neutralization of the threat. Result. The actual problem of information systems security - the threat of «zero-day» is considered. The review of existing neutralization methods and discussion of effective new approaches were carried out. It has been revealed that the main vulnerability is outdated threat signatures. Threat detection is based on a study of the behavior of software a comparison with the previous day tracking is possible mainly by analyzing log files taken from an automated workplace. Conclusion. The content of this work emphasizes the importance of developing methods to neutralize «zero-day» threats in order to avoid the centralized spread of vulnerability and infection of a large number of automated workplaces, which can lead to the suspension of production processes within a large enterprise.

информационная безопасностьатака нулевого дняinformation securityzero-day attackReferencesJournal of Information Security and Applications // Volume 46 June 2019 Pages 164-172Journal of Information Security and Applications. June 2019; 46:164-172Huang, L., Joseph, A., Nelson, H., & Rubinstein, B. Adversarial machine learning // Proceedings of the 4th ACM workshop on Security and artificial intelligence. ACM, 2011. Pp. 43-58.Huang, L., Joseph, A., Nelson, H., & Rubinstein, B. Adversarial machine learning. Proceedings of the 4th ACM workshop on Security and artificial intelligence. ACM, 2011; 43-58.Rieck, K., Trinius, P., Willems, C., Holz, T., & Bos, H. Automatic analysis of malware behavior using machine learning // Journal of Computer Security, 19(4), 639-668.Rieck, K., Trinius, P., Willems, C., Holz, T., & Bos, H. Automatic analysis of malware behavior using machine learning. Journal of Computer Security, 19(4), 639-668.DDoS-атаки. Причины возникновения, классификация и защита от DDoS-атак [Электронный ресурс]. URL: http://efsol.ru/articles/ddos-attacks.html (дата обращения 19.07.2023).DDoS attacks. Causes of occurrence, classification and protection from DDoS attacks [Electronic resource]. URL: http://efsol.ru/articles/ddos-attacks.html (accessed 07.19.2023).Флёнов М. Linux глазами хакера. - СПб.:БХВ-Петербург, 2010.- 480 с.Flenov M. Linux through the eyes of a hacker. - St. Petersburg:BHV-Petersburg, 2010; 480. (In Russ).Нigh-Tech Crime Trends 2017. Group-IB Report. – URL: https://www.group-ib.ru/resources/threat-research/2017-report.html. (Accessed: 18.03.18).Нigh-Tech Crime Trends 2017. Group-IB Report. – URL: https://www.group-ib.ru/resources/threat-research/2017-report.html. (Accessed: 18.03.18).Topical Cyber-threats 2017. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/webinars/ics/webinar_290218.pdf (Accessed: 14.03.18).Topical Cyber-threats 2017. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/webinars/ics/webinar_290218.pdf (Accessed: 14.03.18).Meicong Li, Wei Huang. The Study of APT Attack Stage Model. – URL: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7550947&tag=1 (Accessed: 18.03.18).Meicong Li, Wei Huang. The Study of APT Attack Stage Model. – URL: https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=7550947&tag=1 (Accessed: 18.03.18).Targeted Attack Anatomy. Kaspersky Lab. — URL: https://www.kaspersky.ru/blog/targeted-attack-anatomy/4388/ (Accessed: 15.03.18). (In Russ).Targeted Attack Anatomy. Kaspersky Lab. — URL: https://www.kaspersky.ru/blog/targeted-attack-anatomy/4388/ (Accessed: 15.03.18). (in Russ.).B. B. Gupta, Aakanksha Tewari. Fighting against phishing attacks: state of the art and future challenges. – URL: https://link.springer.com/content/pdf/10.1007%2Fs00521-016-2275-y.pdf (Accessed: 25.03.18).B. B. Gupta, Aakanksha Tewari. Fighting against phishing attacks: state of the art and future challenges. – URL: https://link.springer.com/content/pdf/10.1007%2Fs00521-016-2275-y.pdf (Accessed: 25.03.18).Spear-Phishing Attacks. Why they are successful and how to stop them. FireEye Report. – URL: https://www.fireeye.com/content/dam/fireeye-www/global/en/products/pdfs/wp-fireeye-how-stop-spearphishing.pdf (Accessed: 25.03.18).Spear-Phishing Attacks. Why they are successful and how to stop them. FireEye Report. – URL: https://www.fireeye.com/content/dam/fireeye-www/global/en/products/pdfs/wp-fireeye-how-stop-spearphishing.pdf (Accessed: 25.03.18).How social engineering opens a door to your organization. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/Social-engineering-rus.pdf (Accessed: 16.04.2018). (in Russian).How social engineering opens a door to your organization. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/Social-engineering-rus.pdf (Accessed: 16.04.2018). (In Russ).Topical Cyberthreats 2017— Trends and forecasts. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/Cybersecurity-threatscape-2017-rus.pdf (Accessed: 15.03.18). (in Russian).Topical Cyberthreats 2017 Trends and forecasts. Positive Technologies Report. – URL: https://www.ptsecurity.com/upload/corporate/ru-ru/analytics/Cybersecurity-threatscape-2017-rus.pdf (Accessed: 15.03.18). (In Russ).Tzipora Halevi, Nasir Memon, Oded Nov. Spear-Phishing in the Wild: A Real-World Study of Personality, Phishing Self-efficacy and Vulnerability to Spear-Phishing Attacks. – URL: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2544742 (Accessed: 16.04.2018).Tzipora Halevi, Nasir Memon, Oded Nov. Spear-Phishing in the Wild: A Real-World Study of Personality, Phishing Self-efficacy and Vulnerability to Spear-Phishing Attacks. – URL: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2544742 (Accessed: 16.04.2018).Scott Donnelly. Soft Target: The Top 10 Vulnerabilities Used by Cybercriminals. RecordedFuture Report. – URL: https://go.recordedfuture.com/hubfs/reports/cta-2018-0327.pdf (Accessed: 16.04.2018).Scott Donnelly. Soft Target: The Top 10 Vulnerabilities Used by Cybercriminals. RecordedFuture Report. – URL: https://go.recordedfuture.com/hubfs/reports/cta-2018-0327.pdf (Accessed: 16.04.2018).Gone in a Flash: Top 10 Vulnerabilities Used by Exploit Kits. RecordedFuture Report. — URL: https://www.recordedfuture.com/top-vulnerabilities-2015/ (Accessed: 16.04.2018).Gone in a Flash: Top 10 Vulnerabilities Used by Exploit Kits. RecordedFuture Report. — URL: https://www.recordedfuture.com/top-vulnerabilities-2015/ (Accessed: 16.04.2018).New Kit, Same Player: Top 10 Vulnerabilities Used by Exploit Kits in 2016.] Recorded Future Report. – URL: https://www.recordedfuture.com/top-vulnerabilities-2016/ (Accessed: 16.04.2018).New Kit, Same Player: Top 10 Vulnerabilities Used by Exploit Kits in 2016.] Recorded Future Report. – URL: https://www.recordedfuture.com/top-vulnerabilities-2016/ (Accessed: 16.04.2018).Daniela Oliveira Harold Rocha Huizi Yang. Dissecting Spear Phishing Emails for Older vs Young Adults: On the Interplay of Weapons of Influence and Life Domains in Predicting Susceptibility to Phishing. – URL: https://dl.acm.org/citation.cfm?id=3025831(Accessed: 16.04.2018).Daniela Oliveira Harold Rocha Huizi Yang. Dissecting Spear Phishing Emails for Older vs Young Adults: On the Interplay of Weapons of Influence and Life Domains in Predicting Susceptibility to Phishing. – URL: https://dl.acm.org/citation.cfm?id=3025831(Accessed: 16.04.2018).Thomas, J. E. Individual Cyber Security: Empowering Employees to Resist Spear Phishing to Prevent Identity Theft and Ransomware Attacks. – URL: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3171727 (Accessed: 16.04.2018).Thomas, J. E. Individual Cyber Security: Empowering Employees to Resist Spear Phishing to Prevent Identity Theft and Ransomware Attacks. – URL: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3171727 (Accessed: 16.04.2018).Zhurin S.I., Comprehensiveness of Response to Internal Cyber-Threat and Selection of Methods to Identify the Insider. ICT Res. Appl., Vol. 8, No. 3, 2015, p. 230 – 248.Zhurin S.I., Comprehensiveness of Response to Internal Cyber-Threat and Selection of Methods to Identify the Insider. ICT Res. Appl., 2015; 8(3): 230 – 248.Zhurin S.I. Basics of countermesuares against insider threats. Tutorial for students. MEPhI, 2014. p. 262.Zhurin S.I. Basics of countermesuares against insider threats. Tutorial for students. MEPhI, 2014; 262.

The authors declare that there are no conflicts of interest present.