THE METHODS OF DETECTION UNAUTHORIZED COMPUTER PROCESSES OF INFORMATION AND TELECOMMUNICATION SYSTEMS

Abstract

The article proposes a method for detecting unauthorized computational processes of information and telecommunication systems. Existing APT attack detection technologies are based on multi-level analysis procedures for a large array of data on various current events in ITS. This data is collected in electronic event logs. Obviously, the APT attack model should be able to link events in time and space. Complexes of programs that fill journals with information and implement automated technologies for their analysis are known as SIEM systems. In turn, automated event analysis technologies are based on attack models. An APT attack pattern is a set of interrelated events. Comparison of such a template and current events is the essence of the evaluation process within SIEM. The main task of the methodology is to automate the process of detecting unauthorized actions, deciding on the presence of an APT attack, and implementing methods of protection against it. The basis of the APT attack is a set of actions that are implemented in various components of ITS over a long period of time. From the standpoint of security policy, such events may be legal in nature. Software and hardware designed for covert surveillance of users of information and telecommunications systems are considered. Authorized monitoring software products are used by security administrators of information and telecommunication systems to ensure monitoring. The application for covert monitoring of active processes of information and telecommunication systems is considered in detail. It is proposed to use software and hardware keyloggers as an example of an unauthorized computational process. Methods of protection against them are described in detail. The obtained results should be used to improve methods for detecting unauthorized computing processes of information and telecommunications systems.