{'fraction_non_alphanumeric': 0.012518409425625921, 'fraction_numerical': 0.0, 'mean_word_length': 5.410377358490566, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Detecting Software Malicious Implant Based on Anomalies Research on Local Area Networks

The paper analyzes malicious software implants that use undocumented software features on local area networks. They can cause significant harm both users of personal computers and enterprises that utilize computer networks and use specialized software. In order to detect this type of malware, its possible models and behavioral scenarios, features, stages of research in local area networks have been proposed. Based on this data, a method for detecting computer anomalies has been developed, which is part of a general process for detecting malicious software implants that use undocumented software features. The result of the method is a division of computers on a local network into classes in purpose for further investigation of behavioral patterns. Thus, groups of computer are highlighted in which similar profiles have been formed, that in the overall scheme allows to improve the accuracy of detection. The adopting of the developed models of software implants that use undocumented software features, as well as a method for detecting computer anomalies, have allowed to carry out experimental researches with the use of distributed detection system. The results of the experiments have shown the correctness of the proposed detection enhancement solutions.