MODELING PHISHING SCENARIOS IN UKRAINIAN CYBERSPACE: AN ANALYTICAL APPROACH USING GRAFANA-BOARD

Abstract

The article presents an innovative methodology for modeling phishing scenarios in Ukrainian cyberspace based on data integration in the Grafana environment. The main attention is paid to the detection, classification and typification of phishing domains and malicious content delivery channels (social networks, SMS, messengers, mobile applications). The use of data from HTTP proxy logs, DNS API and NetFlow traffic is proposed to build interactive dashboards that visualize time patterns, top domains, delivery channels and campaigns. Special attention is paid to the economic assessment of damage: financial losses of users are calculated taking into account the number of transitions, average losses per incident and attack topics. The paper also considers the use of machine learning algorithms (decision trees, XGBoost) for automated detection of phishing URLs based on behavioral, content and technical features. A concept for integrating visualization results into SIEM systems (Splunk, QRadar) for rapid response to threats is proposed. The research results are of practical importance for the formation of national cyber defense platforms, the development of state registries of phishing domains, and the implementation of educational programs on cyber hygiene. The presented approach combines technical, analytical, and political and educational components, which ensures its comprehensive nature and relevance in the conditions of the modern hybrid war against Ukraine. Particular attention is paid to visual tools: the implemented Grafana dashboards allow you to track peaks of phishing activity, assess delivery channels, attack themes, and regional distribution features. The proposed visualization model helps increase the efficiency of responding to cyber incidents due to interactivity, adaptability, and the ability to perform deep data analysis in real time. The study also takes into account the socio-cultural context of Ukraine - Ukrainian-language social engineering patterns and demographic factors that affect the effectiveness of phishing campaigns are analyzed. The use of regionalized approaches allows for increased accuracy in threat prediction and flexibility of protective mechanisms. The proposed methodology can be adapted to the needs of government agencies, banking structures, and the corporate sector to build effective digital security strategies.