Year: 2025
Type: article
Abstract: Purpose of the article: development and analysis of anomaly detection methods on Windows system end hosts within a centralized solution of SIEM class, using machine learning and integrated approach, to improve the efficiency and accuracy of detection of potential security threats in the context of modern cyberattacks. Method: the research is based on a theoretical analysis of existing anomaly detection approaches, as well as a practical application of machine learning to analyze security event data collected through SIEM systems. The analysis includes studying the MITRE ATT&CK matrix to identify key events indicative of possible attacks and developing algorithms to detect them. Results: the results of the study show that the developed anomaly detection methodology, based on the analysis of key events of the Windows system and an integrated approach to anomaly detection, allows to significantly improve the accuracy and efficiency of detection of information security incidents in the network infrastructure. This facilitates faster and more accurate response to security threats. Application of the findings can improve anomaly detection systems in Security Operations Centers (SOCs), thus strengthening the overall cybersecurity of organizations. The scientific novelty: work offers a new perspective on anomaly detection, emphasizing the need for complex analysis and the use of machine learning to process large amounts of data collected from SIEM systems. It also emphasizes the importance of adapting anomaly detection techniques to Windows system specifics and taking into account recent trends in cybersecurity
Source: Voprosy kiberbezopasnosti
Authors: M.V Dolgachev, V.A. Kostyunin
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4409621609