<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.3 20210610//EN" "https://jats.nlm.nih.gov/publishing/1.3/JATS-journalpublishing1-3.dtd">
<article article-type="research-article" dtd-version="1.3" xml:lang="ru">
  <front xmlns:xlink="http://www.w3.org/1999/xlink">
    <journal-meta>
      <journal-id journal-id-type="elibrary">9004</journal-id>
      <journal-title-group>
        <journal-title>Problems of information security. Computer systems</journal-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Проблемы информационной безопасности. Компьютерные системы</trans-title>
        </trans-title-group>
      </journal-title-group>
      <issn pub-type="epub">2071-8217</issn>
    </journal-meta>
    <article-meta xmlns:xlink="http://www.w3.org/1999/xlink">
      <article-id pub-id-type="publisher-id">4</article-id>
      <title-group>
        <article-title>Detecting anomalies in security events based on statistical analysis and large language models</article-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Обнаружение аномалий в событиях безопасности ОС на основе статистического анализа и больших языковых моделей</trans-title>
        </trans-title-group>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0009-0001-3348-5038</contrib-id>
          <name>
            <surname>Nemchinov</surname>
            <given-names>Alexander</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>sasha01082004@gmail.com</email>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0000-0002-2009-5460</contrib-id>
          <name>
            <surname>Ovasapyan</surname>
            <given-names>Tigran</given-names>
          </name>
          <xref ref-type="aff" rid="aff2"/>
          <email>otd@ibks.spbstu.ru</email>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0009-0002-7321-7430</contrib-id>
          <name>
            <surname>Zhukovskii</surname>
            <given-names>Evgeniy</given-names>
          </name>
          <xref ref-type="aff" rid="aff2"/>
          <email>bugaev.va@edu.spbstu.ru</email>
        </contrib>
      </contrib-group>
      <aff id="aff1">St. Petersburg State University of Telecommunication Named After Professor M. A. Bonch-Bruevich</aff>
      <aff id="aff2">Peter the Great St. Petersburg Polytechnic University</aff>
      <pub-date publication-format="electronic" date-type="pub" iso-8601-date="2026-06-09">
        <day>09</day>
        <month>06</month>
        <year>2026</year>
      </pub-date>
      <issue>2</issue>
      <fpage>49</fpage>
      <lpage>59</lpage>
      <self-uri xmlns:xlink="http://www.w3.org/1999/xlink" content-type="pdf" xlink:href="https://jisp.spbstu.ru/userfiles/files/soderzhaniya/pib_2.pdf"/>
      <abstract xml:lang="en">
        <p>The possibilities of using large language models and statistical methods to automate the detection of anomalies in OS security events are investigated. A method for detecting anomalies is proposed that allows to automatically identify significant deviations and form their interpretation. A software prototype implementing this method has been developed and tested.</p>
      </abstract>
      <kwd-group xml:lang="en">
        <kwd>Statistical analysis</kwd>
        <kwd>large language models</kwd>
        <kwd>anomaly detection</kwd>
      </kwd-group>
    </article-meta>
  </front>
</article>
