TESTING NEURAL NETWORK MODELS FOR SOLVING THE PROBLEM OF DETECTING INFECTED PCS BASED ON DIGITAL TRACES

Abstract

The development of artificial intelligence has made great progress and already today has a significant impact on a large number of industries and with the development of LLM will have an even greater impact in the future, especially on cybersecurity. AI can both help save data by early detection of cyberattacks, and harm cybersecurity by facilitating the writing of convincing phishing emails, reproducing fragments of malicious code, helping to identify weak points in the network, and finding vulnerabilities in the operating system, programs, etc. that are still unknown to software manufacturers (zero day vulnerability). Therefore, in order not to be lagging behind in this "arms race", it is necessary to already implement AI as one of the components of cyber protection in the enterprise. The relevance of the work lies in the need to find such artificial intelligence models that can already be involved in solving the problems of protecting infocommunication networks. The purpose of the article is to test neural network models of the GGUF format to assess the possibility of their application in solving the problem of detecting infected PCs based on digital traces. The paper considers the types and technologies of artificial intelligence, and their impact on cybersecurity both as protection against cyberattacks and as one of the components for attacks on information infrastructure. In order to assess the possibilities of using existing AI models to solve current cyberdefense problems, in particular, detecting infected PCs based on digital traces using AI, criteria were determined for an AI model that would be acceptable for use in a corporate environment and 135 GGUF format models were tested for their detection or non-detection of signs of viral activity and indicators of compromise in the prompt provided by the user. Since it was found that when running the same neural network model with the same prompts but different programs that can run local models on a PC, its response changes dramatically, a number of summary tables were prepared with the name of the model and answer options for each program for running AI models, excluding those that gave the wrong answer, took too long to answer, or ended with an error. A list of AI models in the GGUF format that are appropriate for use in solving cybersecurity problems, in particular for detecting infected PCs based on digital traces, was determined. However, since each model performs better in specific conditions with different launch scenarios, the choice of model will depend on the current tasks and available resources. Further research can be focused on improving the methodology for studying models for processing digital traces, converting digital traces from a PC into a prompt understandable for AI, and automatically analyzing the AI response.