ellibsЭлектронные библиотекиRussian Digital Libraries Journal1562-5419Казанский (Приволжский) федеральный университетellibs-714Research ArticleСтатьиИсследование алгоритмов обработки, детекции и защиты данных с целью минимизации воздействия вредоносного по и фишинговых атак на пользователей цифровых платформResearch of Data Processing, Detection and Protection Algorithms to Minimize the Impact of Malware and Phishing Attacks on Users of Digital PlatformsВолокитинаТатьяна СергеевнаVolokitinaTatiana Sergeevnatativolokitina@gmail.comТаныгинМаксим ОлеговичTanyginMaxim Olegovichtanygin@yandex.ruЮго-Западный государственный университетSouthwest State University202604032026291187206Copyright © Волокитина Т.С., Таныгин М.О., 20262026Волокитина Т.С., Таныгин М.О.Volokitina T.S., Tanygin M.O.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ellibs.elpub.ru/jour/article/view/714

Статья посвящена разработке научно-методического аппарата повышения эффективности защиты цифровых платформ от киберугроз путем создания алгоритмов обработки и детекции с учетом когнитивных особенностей пользователей. Предложена концептуальная модель трехэтапной системы защиты, интегрирующая технические механизмы безопасности с когнитивными моделями принятия решений. Разработан алгоритм эвристической детекции на основе машинного обучения Random Forest с анализом 47 признаков, включающих технические характеристики URL и когнитивно-семантические характеристики контента. Создана методика динамической интеграции четырех источников данных об угрозах, сокращающая время реагирования с 12–14 ч. до 2 ч. Предложен алгоритм рекурсивного анализа цепочек перенаправлений глубиной до десяти уровней для обнаружения замаскированных угроз. Экспериментальная валидация на эмпирической базе объемом около миллиона записей подтвердила точность детекции 87% при обработке ста тысяч записей в час. Разработанные решения обеспечивают соответствие требованиям ГОСТ Р 57580.1–2017 и российского законодательства в области защиты персональных данных.

The article is devoted to the development of a scientific and methodological apparatus for improving the effectiveness of protecting digital platforms from cyber threats by creating processing and detection algorithms that take into account the cognitive characteristics of users. A conceptual model of a three-stage protection system is proposed, integrating technical security mechanisms with cognitive decision-making models. A heuristic detection algorithm based on Random Forest machine learning with analysis of 47 features, including technical URL characteristics and cognitive-semantic content characteristics, has been developed. A methodology for dynamic integration of four threat data sources has been created, reducing response time from 12–14 hours to two hours. An algorithm for recursive analysis of redirection chains up to ten levels deep to detect masked threats is proposed. Experimental validation on an empirical base of approximately one million records confirmed detection accuracy of 87% when processing one hundred thousand records per hour. The developed solutions ensure compliance with the requirements of GOST R 57580.1-2017 and Russian legislation in the field of personal data protection.

эвристическая детекция угрозмашинное обучениекогнитивная безопасностьфишинговые атакисоциальная инженериязащита данныхинтеграция источников угрозheuristic threat detectionmachine learningcognitive securityphishing attackssocial engineeringdata protectionthreat source integrationReferencesSeliverstov V.V., Korchagin S.A. Analysis of the relevance and state of modern phishing attacks on critical information infrastructure objects // Engineering Bulletin of the Don. 2024. No. 6 (114). P. 17.Seliverstov V.V., Korchagin S.A. Analysis of the relevance and state of modern phishing attacks on critical information infrastructure objects // Engineering Bulletin of the Don. 2024. No. 6 (114). P. 17.Group-IB. Report on cyber threats in Russia for 2023: analysis of trends and forecasts. Moscow: Group-IB, 2024. 89 p.Group-IB. Report on cyber threats in Russia for 2023: analysis of trends and forecasts. Moscow: Group-IB, 2024. 89 p.Kaspersky Lab. Development of cyber threats in 2023: statistics and analytics of information security incidents. Moscow: Kaspersky Laboratory, 2024. 156 p.Kaspersky Lab. Development of cyber threats in 2023: statistics and analytics of information security incidents. Moscow: Kaspersky Laboratory, 2024. 156 p.Russkikh E.I. Past, present and future of phishing attacks // BBK 1 N 34. P. 6015.Russkikh E.I. Past, present and future of phishing attacks // BBK 1 N 34. P. 6015.Nazarov A.K. Some modern means of protection against cyber threats // Editorial and publishing council of the Krasnodar University of the Ministry of Internal Affairs of Russia. P. 76.Nazarov A.K. Some modern means of protection against cyber threats // Editorial and publishing council of the Krasnodar University of the Ministry of Internal Affairs of Russia. P. 76.Bryukhanov V.A., Gryzunov V.V., Shestakov A.V. Identification of information security problems by the method of systematic literature review. 2024.Bryukhanov V.A., Gryzunov V.V., Shestakov A.V. Identification of information security problems by the method of systematic literature review. 2024.Tokolov A.V. Social engineering in information security issues // Criminological Journal. 2024. No. 4. P. 175–182.Tokolov A.V. Social engineering in information security issues // Criminological Journal. 2024. No. 4. P. 175–182.Gorbunova E.A., Saykinov V.E. Russian Federation The problem of phishing in the use of information systems based on cloud technologies // I74 Information Society: current state and development prospects: collection of materials of the XI international student forum. Krasnodar: KubSAU, 2018. P. 103.Gorbunova E.A., Saykinov V.E. Russian Federation The problem of phishing in the use of information systems based on cloud technologies // I74 Information Society: current state and development prospects: collection of materials of the XI international student forum. Krasnodar: KubSAU, 2018. P. 103.Sergeev A.Yu., Shirokova O.V. Fraud in digital society under conditions of social change // Digital Sociology. 2023. Vol. 6, No. 1. P. 59–71.Sergeev A.Yu., Shirokova O.V. Fraud in digital society under conditions of social change // Digital Sociology. 2023. Vol. 6, No. 1. P. 59–71.Mrochko V.L., Roschina T.M., Tarasov M.D. Ensuring security on the Internet: psychological and pedagogical aspects // Economic and socio-humanitarian research. 2024. No. 3 (43). P. 196–204.Mrochko V.L., Roschina T.M., Tarasov M.D. Ensuring security on the Internet: psychological and pedagogical aspects // Economic and socio-humanitarian research. 2024. No. 3 (43). P. 196–204.Serik A.S. Legal foundations for preventing cybercrime: state and development prospects. 2022.Serik A.S. Legal foundations for preventing cybercrime: state and development prospects. 2022.Shvetsova E.E. Types of fraud in the field of remote banking and methods of combating them // Collection of materials of the All-Russian scientific conference of young researchers with international participation INTEX-2024. 2024. P. 269–272.Shvetsova E.E. Types of fraud in the field of remote banking and methods of combating them // Collection of materials of the All-Russian scientific conference of young researchers with international participation INTEX-2024. 2024. P. 269–272.Uvarov A.A. Information security of Russian citizens: current state // Lex russica. 2024. Vol. 77, No. 1 (206). P. 133–143.Uvarov A.A. Information security of Russian citizens: current state // Lex russica. 2024. Vol. 77, No. 1 (206). P. 133–143.Kharisova Z.I. Genesis of crime in the field of computer information and its determinants // Society, law, statehood: retrospective and perspective. 2025. No. 1 (21). P. 57–65.Kharisova Z.I. Genesis of crime in the field of computer information and its determinants // Society, law, statehood: retrospective and perspective. 2025. No. 1 (21). P. 57–65.Bityukova A.F. Directions for the development of banking electronic services and methods of ensuring their security. 2019.Bityukova A.F. Directions for the development of banking electronic services and methods of ensuring their security. 2019.GOST R 57580.1-2017. Security of financial (banking) operations. Requirements for the organization and conduct of security work. Moscow: Standartinform, 2017. 26 p.GOST R 57580.1-2017. Security of financial (banking) operations. Requirements for the organization and conduct of security work. Moscow: Standartinform, 2017. 26 p.Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (as amended on July 14, 2022). Access from the reference legal system "ConsultantPlus".Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (as amended on July 14, 2022). Access from the reference legal system "ConsultantPlus".Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Information Protection" (as amended on July 14, 2022). Access from the reference legal system "ConsultantPlus".Federal Law No. 149-FZ of July 27, 2006 "On Information, Information Technologies and Information Protection" (as amended on July 14, 2022). Access from the reference legal system "ConsultantPlus".Sheng S., Holbrook M., Kumaraguru P., Cranor L.F., Downs J. Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions // Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. Atlanta, GA, USA, 2010. P. 373–382. https://doi.org/10.1145/1753326.1753383Sheng S., Holbrook M., Kumaraguru P., Cranor L.F., Downs J. Who falls for phish? A demographic analysis of phishing susceptibility and effectiveness of interventions // Proceedings of the SIGCHI Conference on Human Factors in Computing Systems. Atlanta, GA, USA, 2010. P. 373–382. https://doi.org/10.1145/1753326.1753383Guarino N. Formal ontology, conceptual analysis and knowledge representation // Int. J. of Human Computer Studies. 1995. Vol. 43 (5/6). P. 625–640.Guarino N. Formal ontology, conceptual analysis and knowledge representation // Int. J. of Human Computer Studies. 1995. Vol. 43 (5/6). P. 625–640.

The authors declare that there are no conflicts of interest present.