Zero-day Vulnerabilities Research Articles

Converter-Based Moving Target Defense Against Deception Attacks in DC Microgrids

With the rapid development of information and communications technology in DC microgrids (DCmGs), the deception attacks, which typically include false data injection and replay attacks, have been widely recognized as a significant threat. However, existing literature ignores the possibility of the intelligent attacker, who could launch deception attacks once obtaining necessary information by exploiting zero-day vulnerabilities or bribing insiders, to affect the system in an unforeseeable manner. In this paper, based on the observation that the primary control law of the power converter device in DCmGs is usually programmable, we propose a novel converter-based moving target defense (CMTD) strategy by proactively perturbing the primary control gains to defend against deception attacks. First, we study the impact of perturbing the primary control gains on the voltage stability in DCmGs and provide explicit conditions for the perturbation magnitude and frequency under which the voltage stability can be ensured. Then, we investigate the improved detectability against deception attacks under CMTD and present sufficient conditions under which these attacks can be detected. Finally, we conduct extensive MATLAB SIMULINK/PLECS based simulations and systematic hardware-in-the-loop based experiments to validate the effectiveness of CMTD.

LogInjector: Detecting Web Application Log Injection Vulnerabilities

Web applications widely use the logging functionality, but improper handling can bring serious security threats. An attacker can trigger the execution of malicious data by writing malicious data to the web application logs and then accessing the view–logs interface, resulting in a vulnerability of the web application log injection. However, detecting this type of vulnerability requires automatic discovery of log-injectable interfaces and view–logs interfaces, which is difficult. In addition, bypasssing the application-specific input-filtering checks to write an effective payload to the log is also challenging. This paper proposes LogInjector, an efficient web application log injection vulnerability detection method. First, it obtains the log storage form and location and then finds the log-injectable interfaces through the extended dynamic crawler. Second, it automatically identifies the web application view–logs interfaces. Finally, LogInjector utilizes a dynamic testing approach based on the feedback-guided mutation to detect web application log injection vulnerabilities. To verify the effectiveness of LogInjector, we test it in 14 popular web applications in real-world cases and compare it with Black Widow, the state-of-the-art web vulnerability scanner. LogInjector detects 16 web application log injection vulnerabilities, including 6 zero-day vulnerabilities, while Black Widow can only detect three log injection vulnerabilities, demonstrating the effectiveness of LogInjector in practice.

Cloud-BlackBox: Toward practical recording and tracking of VM swarms for multifaceted cloud inspection

Given the widening scope of the utilization and application of cloud computing services from general to mission-critical systems such as strategic military, financial, and the information systems of governmental agencies, the need for the development of improved methods to ensure the stability and security of cloud data and services is being increasingly emphasized. Various approaches have been developed to improve the security and stability of cloud infrastructure. In particular, the continuous inspection of the memory of Virtual Machine (VM) instances in the cloud platform has been an important factor in identifying the causes of security incidents related to zero-day vulnerabilities and critical system faults in cloud infrastructure. However, despite numerous studies in the field of continuous memory inspection, it is difficult to find a practical solution that is deployable in commercial-off-the-shelf cloud platforms. For instance, continuous memory snapshots generally cause various problems such as increased VM downtime occurrences, user-obstructive latency for memory snapshots, VM performance degradation, and massive data generation. To alleviate these limitations, we propose Cloud-BlackBox, which enables the recording of the memory of VM swarms running on cloud platforms that require a very high level of stability and security, and facilitates the flexible analysis of the recorded memory on a large-scale. A VM swarm refers to an environment in which multiple VMs are run in parallel. The proposed Cloud-BlackBox method provides the following benefits. First, by clustering VM swarm kernel memory, the amount of computation required to capture memory snapshots and the size of the generated snapshot images are minimized. Further, we propose a mechanism to merge kernel memory by rapidly identifying the homogeneity of the memory layout through analysis of the underlying base image and introspection of the running VM. The application of the proposed mechanism led to a storage reduction by a factor of 12.85. Second, a cognitive-scale bitmap was designed to track changes in the memory of VM swarms. The cognitive-scale bitmap is a mechanism that can dynamically manage the tracking of memory change information by recognizing the memory usage patterns of component VMs. With the designed cognitive-scale bitmap, the time required for the collection of a memory snapshot was reduced by more than 14.85 times, and the VM input/output (I/O) performance degradation was reduced by 50%. Third, a synchronized accessible memory interchange (SAMI) mechanism is proposed to facilitate the agile in-depth analysis of large-scale memory resources. Cloud-BlackBox tracks and records memory change information. Therefore, a procedure for restoring the recorded memory to a raw-memory analyzable form is required to analyze the recorded memory. The SAMI mechanism assists the analyst in ensuring consistent memory restoration performance when arbitrarily selecting recorded memory. Furthermore, SAMI is useful for reducing the scope of analysis without memory restoration simply by analyzing recorded metadata. Consequently, the revised schemes inside Cloud-BlackBox have several applications in various fields, such as advanced detection of malicious activities, service error recovery, malware analysis, and antivirus functions. In addition, the proposed approach has been implemented on a campus-wide cloud computing service called SysCore-Cloud.

Cyber Threats and Nuclear Security in India

State and non-state actors are increasingly using cyberspace as a platform to execute hybrid warfare. As multiple incidents in India have shown critical infrastructures, particularly nuclear infrastructures, have been lucrative targets of cyber-attacks. Considering India’s well-progressing civilian and military nuclear infrastructures, it is apposite to raise the question of how safe these nuclear infrastructures are from cyber threats. This article suggests that India’s nuclear infrastructures will remain exposed to cyber-attacks due to their strategic significance for India’s national security. These threats will continue to exploit the zero-day vulnerabilities in the cyber-physical systems of these infrastructures. Further, the article looks into the threat sources, consequences and mitigation strategies against cyber-attacks on nuclear infrastructures. In an attempt to explore mitigation strategies, the article discusses certain cyber-attack scenarios and the consequences on India’s nuclear infrastructures. The article concludes that while certain technological cyber-defence mechanisms are in place, there is a need for legislative and diplomatic measures for developing a comprehensive set of measures to deter cyber threats to India’s nuclear infrastructures.

Vulnerabilities of Live-Streaming Services in Korea.

Recently, the number of users and the demand for live-streaming services have increased. This has exponentially increased the traffic to such services, and live-streaming service platforms in Korea use a grid computing system that distributes traffic to users and reduces traffic loads. However, ensuring security with a grid computing system is difficult because the system exchanges general user traffic in a peer-to-peer (P2P) manner instead of receiving data from an authenticated server. Therefore, in this study, to explore the vulnerabilities of a grid computing system, we investigated a vulnerability discovery framework that involves a three-step analysis process and eight detailed activities. Four types of zero-day vulnerabilities, namely video stealing, information disclosure, denial of service, and remote code execution, were derived by analyzing a live-streaming platform in Korea, as a representative service, using grid computing.

Cyber-Physical Coordinated Risk Mitigation in Smart Grids Based on Attack-Defense Game

Since modern smart grids have various and deeply coupled cyber-physical components, they are vulnerable to malicious cyber attacks. Although regular defenses including firewall and IDS are deployed, they may be weakened by zero-day vulnerabilities and sophisticated attack schemes. Therefore, defense strategies to mitigate the risk of blackouts during cyber attacks are necessary. This paper proposes a cyber-physical coordinated defense strategy to overcome the disruption and minimize the risk as much as possible. At the cyber layer, a zero-sum multilevel Markovian Stackelberg game is proposed to model sequential actions of the attacker and the defender. The defender distributes defensive resources to protect lines in a real-time manner, according to the attacker's action. If cyber attacks should result in physical outages, defense at the physical layer is then employed. A security-constrained optimal power flow reserving security margin of critical components will be performed to minimize the blackout scale and potential future risk. To solve the corresponding optimization problem and further get the optimal defense strategy, this paper devises a novel “water-pouring” algorithm. Lastly, test results show that the proposed dynamic defense strategy mitigates risk significantly and outperforms existing methods.

Automatically Seed Corpus and Fuzzing Executables Generation Using Test Framework

Fuzzing is widely utilized as a practical test method to determine unknown vulnerabilities in software. Although fuzzing shows excellent results for code coverage and crash count, it is not easy to apply these effects to library fuzzing. A library cannot run independently; it is only executed by an application called a customer program. In particular, a fuzzing executable and a seed corpus are needed to execute the library code by calling a specific function sequence and passing the input of the fuzzer to reproduce the various states of the library. However, preparing the environment for library fuzzing is challenging because it relies on the human expertise and requires both an understanding of the library and fuzzing knowledge. This study proposes <i>FuzzBuilderEx</i>, a system that provides an automated fuzzing environment for a library by utilizing the test framework to resolve this problem. <i>FuzzBuilderEx</i> conducts a static/dynamic analysis of the test code to automatically generate seed corpus and fuzzing executables that enable library fuzzing. Furthermore, the automatically generated seed corpus and fuzzing executable are compatible with existing fuzzers, such as the American Fuzzy Lop (AFL). This study applied <i>FuzzBuilderEx</i> to nine open-source libraries for performance evaluation and confirmed the effects of an increase in code coverage by 31.2% and a unique crash count of 58.7% compared to previous studies. Notably, we detected three zero-day vulnerabilities and registered one of them in the common vulnerabilities and exposures (CVE) database.

Explainable Artificial Intelligence in CyberSecurity: A Survey

Nowadays, Artificial Intelligence (AI) is widely applied in every area of human being’s daily life. Despite the AI benefits, its application suffer from the opacity of complex internal mechanisms and doesn’t satisfy by design the principles of Explainable Artificial Intelligence (XAI). The lack of transparency further exacerbates the problem in the field of Cybersecurity because entrusting crucial decisions to a system that cannot explain itself presents obvious dangers. There are several methods in the literature capable of providing explainability of AI results. Anyway, the application of XAI in Cybersecurity can be a double-edged sword. It substantially improves the Cybersecurity practices but simultaneously leaves the system vulnerable to adversary attacks. Therefore, there is a need to analyze the state-of-the-art of XAI methods in Cybersecurity to provide a clear vision for future research. This study presents an in-depth examination of the application of XAI in Cybersecurity. It considers more than 300 papers to comprehensively analyze the main Cybersecurity application fields, like Intrusion Detection Systems,Malware detection, Phishing and Spam detection, BotNets detection, Fraud detection, Zero-Day vulnerabilities, Digital Forensics and Crypto-Jacking. Specifically, this study focuses on the explainability methods adopted or proposed in these fields, pointing out promising works and new challenges.

Future Methods Of Managing Privacy And Data Security At The Technical Age Cashless Society

Financial transactions in a cashless global are carried out the usage of virtual statistics in place of real banknotes or coins (commonly an digital illustration of cash). [1] Cashless civilizations have existed for the reason that sunrise of human civilization, primarily based totally on barter and different varieties of exchange, and cashless transactions at the moment are possible utilizing credit score playing cards, debit playing cards, cellular bills, and virtual currencies which include bitcoin. However, this newsletter makes a speciality of the term "cashless society" withinside the feel of a motion toward, and implications of, a society wherein coins is changed with the aid of using its virtual equal—in different words, criminal tender (cash) exists, is recorded, and is most effective traded in digital virtual form. A few publications of movement may be coupled to attain a everlasting and applicable result for customers in a cashless society to boom privateness: A new kind of banking carrier that assigns randomised numbers to credit score playing cards, using blockchain to song all man or woman transactions, and a marketing campaign to train and tell key stakeholders approximately safety and privateness dangers so that they have got the gear and historical past expertise to guard their personal statistics earlier than coping with a overseas entity or different 1/3 events (i.e. cybersecurity departments, IT technicians, etc). Both blockchain and card variety randomization are liable to zero-day vulnerabilities, flaws, and ranging ranges of social acceptance. This exploratory observe makes use of a structures evaluation of cashless structures to perceive and have a look at a fixed of social and technical alternatives for a robust cashless gadget that protects customers' privateness even as keeping gadget safety. The statistics amassed and evaluated may be beneficial in uncovering flaws in present day facts integrity and safety procedures. In order to create preemptive countermeasures, it might be useful to study gift and destiny strategies of dealing with privateness and facts safety withinside the contemporary-day age. In a cashless gadget, this studies identifies essential techniques to keep away from the loss of private privateness.

Thinking like a lawyer

On December 9, 2021, Apache announced a zero-day vulnerability in Apache Log4j [3]. As the news broke, tech companies and computing administrators scrambled to push out recommended mitigations. If you are reading this, chances are you already heard about this vulnerability and have made sure to update all of your systems. It is estimated that millions of companies are vulnerable to data breach through exploits of this widely used logging software. When millions of companies are vulnerable to breach it means that lots of people are going to have their data stolen and will suffer financial losses.

Patching zero-day vulnerabilities: an empirical analysis

Abstract Zero-day vulnerabilities remain one of the major security threats that are faced by organizations. Once a vendor learns about a zero-day vulnerability, releasing a timely patch becomes a priority given the risk of zero-day exploits. However, we still lack information on the factors that affect patch release time of such vulnerabilities. The main objective of this study is to examine the impact of other as-yet unexplored factors on the patch release time of zero-day vulnerabilities. Using zero-day vulnerability dataset captured between 2010 and 2020, we employ survival analysis technique. Our model explores the impact of vulnerability attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability impact on patch release timing. Findings show that a zero-day vulnerability is more likely to be patched on time if the vulnerability results in a scope change and affects more vendors, products, and versions. However, a zero-day vulnerability is less likely to be patched on time if it requires privileges and impacts confidentiality. Our sub-analyses also reveal how patch release times vary across different products and vulnerability types.

An Enhanced Classification Model for Likelihood of Zero-Day Attack Detection and Estimation

The growing threat to sensitive information stored in computer systems and devices is becoming alarming. This is as a result of the proliferation of different malware created on a daily basis to cause zero-day attacks. Most of the malware whose signatures are known can easily be detected and blocked, however, the unknown malwares are the most dangerous. In this paper a zero-day vulnerability model based on deep-reinforcement learning is presented. The technique employs a Monte Carlo Based Pareto Rule (Deep-RL-MCB-PR) approach that exploits a reward learning and training feature with sparse feature generation and adaptive multi-layered recurrent prediction for the detection and subsequent mitigation of zero-day threats. The new model has been applied to the Kyoto benchmark datasets for intrusion detection systems, and compared to an existing system, that uses a multi-layer protection and a rule-based ranking (RBK) approach to detect a zero-day attack likelihood. Experiments were performed using the dataset, and simulation results show that the Deep-RL-MCB-PR technique when measured with the classification accuracy metrics, produced about 67.77%. The dataset was further magnified, and the result of classification accuracy showed about 75.84%. These results account for a better error response when compared to the RBK technique.

Threat Assessment Model in Electrical Power Grid Environment

At the heart of every critical national infrastructure, there is a SCADA system. The wide range of supported applications has made this life-saving management system the key element of every industrial control infrastructure in various sectors. The complexity and sophistication of SCADA systems have been increased dramatically over the last few years. Various cyberattacks have targeted these systems by exploiting zero-day vulnerabilities or targeting a nearby Internet-enabled appliance or computer system. To this end, many efforts have been proposed previously to model the threats on SCADA systems to eliminate potential danger and diminish the catastrophic consequences in the physical domain. The main contribution of this work is to present a multi-facets threat assessment model to aid security teams to systematically perform various cybersecurity analysis practices such as penetration testing, vulnerability assessment and risk analysis.

AutoVAS: An automated vulnerability analysis system with a deep learning approach

Owing to the advances in automated hacking and analysis technologies in recent years, numerous software security vulnerabilities have been announced. Software vulnerabilities are increasing rapidly, whereas methods to analyze and cope with them depend on manual analyses, which result in a slow response. In recent years, studies concerning the prediction of vulnerabilities or the detection of patterns of previous vulnerabilities have been conducted by applying deep learning algorithms in an automated vulnerability search based on source code. However, existing methods target only certain security vulnerabilities or make limited use of source code to compile information. Few studies have been conducted on methods that represent source code as an embedding vector. Thus, this study proposes a deep learning-based automated vulnerability analysis system (AutoVAS) that effectively represents source code as embedding vectors by using datasets from various projects in the National Vulnerability Database (NVD) and Software Assurance Reference Database (SARD). To evaluate AutoVAS, we present and share a dataset for deep learning models. Experimental results show that AutoVAS achieves a false negative rate (FNR) of 3.62%, a false positive rate (FPR) of 1.88%, and an F1-score of 96.11%, which represent lower FNR and FPR values than those achieved by other approaches. We further apply AutoVAS to nine open-source projects and detect eleven vulnerabilities, most of which are missed by the other approaches we experimented with. Notably, we discovered three zero-day vulnerabilities, two of which were patched after being informed by AutoVAS. The other vulnerability received the Common Vulnerabilities and Exposures (CVE) ID after being detected by AutoVAS.

Generalized Outlier Gaussian Mixture Technique Based on Automated Association Features for Simulating and Detecting Web Application Attacks

Web application attacks constitute considerable security threats to computer networks and end users. Existing threat detection methods are mostly designed on signature-based approaches which cannot recognize zero-day vulnerabilities. Moreover, with the minimal availability of real-world web attack data, the effectiveness of such approaches is limited further. In this paper, we propose an architectural scheme for designing a threat intelligence technique for web attacks to address these challenges through a four-step methodology: 1) collecting web attack data by crawling websites and accumulating network traffic for representing this data as feature vectors; 2) dynamically extracting important features using the Association Rule Mining (ARM) algorithm; 3 ) using these extracted features to simulate web attack data; and 4) proposing a new Outlier Gaussian Mixture (OGM) technique for detecting known as well as zero-day attacks based on the anomaly detection methodology. The performance of the scheme is appraised using two well-known datasets, namely, the Web Attack and UNSW-NB15 datasets. The empirical evaluations demonstrate that the proposed scheme outperforms four other competing machine learning mechanisms in terms of detection rate and false alarm rates on both the original as well as simulated web data.

A system dynamics, epidemiological approach for high-level cyber-resilience to zero-day vulnerabilities

ABSTRACT Cyber-attacks are serious threats to operations in most industries, enabled by a growing dependence on Information Technology (IT). To minimise disruptive effects on operations, organisations with complex system derive value both from preventing cyber-attacks and from responding promptly and coherently when cyber-attacks happen, capacity is known as cyber-resilience. Frameworks have been presented in literature to promote cyber-resilient response, yet little is known about the structures that result in a cyber-resilient behaviour. This paper explores an approach to modelling the structure of a system that is subject to an infection an eventual recovery from zero-day malware cyber-attacks, based on mechanisms derived from epidemiology. By analysing the relationship between the system vulnerabilities and the incidence of malware infections in a population of systems, this paper derives structural recommendations for resilience response, and policy requirements based on the claim that cyber-threats are a public-cyber-health issue instead of merely a competitive factor.

Implementing Security in IoT Ecosystem Using 5G Network Slicing and Pattern Matched Intrusion Detection System: A Simulation Study

Aim/Purpose: 5G and IoT are two path-breaking technologies, and they are like wall and climbers, where IoT as a climber is growing tremendously, taking the support of 5G as a wall. The main challenge that emerges here is to secure the ecosystem created by the collaboration of 5G and IoT, which consists of a network, users, endpoints, devices, and data. Other than underlying and hereditary security issues, they bring many Zero-day vulnerabilities, which always pose a risk. This paper proposes a security solution using network slicing, where each slice serves customers with different problems. Background: 5G and IoT are a combination of technology that will enhance the user experience and add many security issues to existing ones like DDoS, DoS. This paper aims to solve some of these problems by using network slicing and implementing an Intrusion Detection System to identify and isolate the compromised resources. Methodology: This paper proposes a 5G-IoT architecture using network slicing. Research here is an advancement to our previous implementation, a Python-based software divided into five different modules. This paper’s amplification includes induction of security using pattern matching intrusion detection methods and conducting tests in five different scenarios, with 1000 up to 5000 devices in different security modes. This enhancement in security helps differentiate and isolate attacks on IoT endpoints, base stations, and slices. Contribution: Network slicing is a known security technique; we have used it as a platform and developed a solution to host IoT devices with peculiar requirements and enhance their security by identifying intruders. This paper gives a different solution for implementing security while using slicing technology. Findings: The study entails and simulates how the IoT ecosystem can be variedly deployed on 5G networks using network slicing for different types of IoT devices and users. Simulation done in this research proves that the suggested architecture can be successfully implemented on IoT users with peculiar requirements in a network slicing environment. Recommendations for Practitioners: Practitioners can implement this solution in any live or production IoT environment to enhance security. This solution helps them get a cost-effective method for deploying IoT devices on a 5G network, which would otherwise have been an expensive technology to implement. Recommendation for Researchers: Researchers can enhance the simulations by amplifying the different types of IoT devices on varied hardware. They can even perform the simulation on a real network to unearth the actual impact. Impact on Society: This research provides an affordable and modest solution for securing the IoT ecosystem on a 5G network using network slicing technology, which will eventually benefit society as an end-user. This research can be of great assistance to all those working towards implementing security in IoT ecosystems. Future Research: All the configuration and slicing resources allocation done in this research was performed manually; it can be automated to improve accuracy and results. Our future direction will include machine learning techniques to make this application and intrusion detection more intelligent and advanced. This simulation can be combined and performed with smart network devices to obtain more varied results. A proof-of-concept system can be implemented on a real 5G network to amplify the concept further.

Pegasus Spyware – 'A Privacy Killer'

The recent Pegasus Project revelations of about half a lakh people across the world, including several in India, being targeted for cyber surveillance has firmly brought the spotlight on the Pegasus spyware, which is widely understood to be the most sophisticated smartphone attack tool. The revelations also mark the first time that a malicious remote jailbreak exploit had been detected within an iPhone. Pegasus is a spyware (Trojan/Script) that can be installed remotely on devices running on Apple’s iOS & Google’s Android operating systems. It is developed and marketed by the Israeli technology firm NSO Group. NSO Group sells Pegasus to “vetted governments” for “lawful interception”, which is understood to mean combating terrorism and organized crime, as the firm claims, but suspicions exist that it is availed for other purposes.Pegasus is a modular malware that can initiate total surveillance on the targeted device, as per a report by digital security company Kaspersky. It installs the necessary modules to read the user’s messages and mail, listen to calls, send back the browser history and more, which basically means taking control of nearly all aspects of your digital life. It can even listen in to encrypted audio and text files on your device that makes all the data on your device up for grabs.Since Pegasus hacks into the operating system, every activity within the phone can be monitored when the phone is switched on. It's as if someone is monitoring your phone activity over your shoulders. Pegasus operators can remotely record audio and video from your phone, extract phone messages, use GPS for location tracking, and recover passwords and authentication keys without the user even noticing. It's only when a device is sent for forensic screening, and experts look into the transfer of data to and from the phone, is when a potential attack can be confirmed. The dooming fact of it all is that since Pegasus exploits zero-day vulnerabilities, there is nothing that can be done regarding such breaches unless operating system developers proactively ship out an update to your phone, aimed to protect you from hi-tech malware like Pegasus.

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Cyberattacks can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyber-physical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injection-based Man-in- The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.

КРИПТОГРАФИЧЕСКАЯ КОНТЕЙНЕРИЗАЦИЯ ДАННЫХ В ОБРАБОТКЕ НЕЙРОННЫХ СЕТЕЙ ГЛУБОКОГО ОБУЧЕНИЯ

Introduction: the existing development of methods for ensuring information security in the field of information technology allows you to control the confidentiality of personal data at variable levels. Hardware solutions can be portable cryptographic keys, as well as narrowly targeted biometric identification devices. Software solutions are methods of static verification using sequences and side-tools for deploying data virtualization systems. The main problem that stands out among the methods described above is the need for additional hardware that acts as tokens, infrared cameras, and biometric identification sensors. An alternative problem is the lack of security of software solutions, since the presence of zero-day vulnerabilities can reduce security, which leads to the possibility of interception of confidential data by third parties. Purpose of the research is expressed in the analysis and development of software methods and algorithms for ensuring data security based on containerization methods. The developed software solution allows you to perform application tasks in a secure container, while the implemented authentication methods support the ability to identify an individual both using sequences and using the Windows Hello application programming interface. Methods used: security methods and algorithms aimed at implementing a unique cryptographic algorithm. The results of the studied methods and algorithms for scanning a bounded shell allow us to variatively select the optimal outcomes of internal process instances along with the implementation of cryptographic methods. Application software is based on the joint use of virtualization tools and methods of interaction through neural network technologies. The isolation of this solution from alternative methods lies in the possibility of using the container without significant hardware resources and lack of primary knowledge in configuring the software module. Practical significance lies in the possibility of using methods and algorithms in the construction of secure jobs in small and medium-sized businesses.