Zhuravchak D. Improvement of real time ransomware detection methods

The dissertation solved an important scientific and practical problem of increasing the effectiveness of detecting ransomware in the infrastructure of information systems by using machine learning models and eBPF technology. For the first time, a model of an integrated data collection system for the detection of ransomware viruses has been developed, combining the use of eBPF for monitoring system calls, file and cryptographic activity, network traffic and process analysis. This system provides a unique set of data (features) that are used to effectively identify potential threats in real time. For the first time, a complex model for classification of ransomware viruses using an ensemble of decision trees and a random forest is proposed, which allows to distinguish "safe" and "dangerous" programs with high accuracy based on the analysis of complex behavioral patterns and cryptographic activity. For the first time, a methodology for applying deep neural networks is proposed to identify complex patterns in data collected by eBPF modules representing the behavior of ransomware viruses, providing a new level of accuracy in detecting unknown or evolved threats. The methods of detecting cyber threats by analyzing network traffic using eBPF have been further developed, which significantly increases the speed and accuracy of identifying potential ransomware attacks compared to traditional approaches. The method of simulating cyberattacks with the help of a fraudster's action emulation model has been improved to test and evaluate the effectiveness of the developed models, simultaneously, including the launch of ransomware viruses in a controlled laboratory environment. This made it possible to analyze in detail the response of models to various attack scenarios and optimize them for maximum efficiency. Received further development: methods of comparative analysis and evaluation of the effectiveness of mathematical devices for detecting and countering ransomware programs, using the MCC metric (Matthew's correlation coefficient), which proved to be more effective for evaluating models that work with unbalanced data, typical of cyber threat scenarios such as ransomware viruses.