Architecture design of ML-based spoofing detection solution

Bulba, Serhii та Yefimov, Danylo та Kriuchkova, Larysa та Kyrychok, Roman та Obushnyi, Sergiy (2026) Architecture design of ML-based spoofing detection solution Cybersecurity Providing in Information and Telecommunication Systems 2026 (4271). с. 11-20. ISSN 1613-0073

Текст S_Bulba_D_Yefimov_L_Kriuchkova_R_Kyrychok_S_Obushnyi_CPITS_2026_4271_FITM.pdf - Опублікована версія Download (864kB)

Анотація

The paper explores theoretical and practical approaches to detecting spoofing as a component of modern cyberattacks using machine learning and deep learning methods. The methodological apparatus is based on general scientific methods of analysis, synthesis, induction, and deduction, as well as specialized methods of search and semantic analysis of scientific sources. The aim of the work is to generalize existing approaches to detecting spoofing attacks and to develop an optimal conceptual architecture for a software solution to identify spoofing risks. The empirical basis of the review was formed by systematizing and interpreting 23 relevant scientific papers, which reflect the evolution from single-factor rule-based mechanisms to multi-level architectures with multimodal feature integration. The paper clarifies the essence of spoofing as a hidden cyberthreat that exploits protocol vulnerabilities and the imperfections of authentication mechanisms, while accounting for the human factor. A classification of key types of spoofing (email, IP, DNS, ARP, caller ID, website, GPS) was performed, and their consequences for the confidentiality, integrity, and availability of information resources were determined. Based on the review, requirements for anti-spoofing solutions in corporate environments were formed, in particular for email spoofing and Business Email Compromise scenarios. An Explainable AI module was also integrated to form an evidence package, increase transparency in decision-making, and support operational incident analysis. The features of implementing the architecture in the AWS environment, using managed services for orchestration, streaming processing, storage, and model deployment, were considered. The results obtained confirm that multimodal and ensemble approaches are the most promising for increasing accuracy, resistance to zero-day scenarios, and controllability of anti-spoofing systems.

Тип елементу :	Стаття
Ключові слова:	spoofing; phishing; email spoofing; Business Email Compromise; machine learning; deep learning; multimodal detection; ensemble models; Explainable AI; software solution architecture; AWS; near-realtime ML pipeline
Типологія:	Статті у базах даних > Scopus (без квартилю)
Підрозділи:	Факультет інформаційних технологій та математики > Кафедра інформаційної та кібернетичної безпеки ім. професора Володимира Бурячка
Користувач, що депонує:	Роман Васильович Киричок
Дата внесення:	13 Жов 2026 10:41
Останні зміни:	13 Жов 2026 10:41
URI:	https://elibrary.kubg.edu.ua/id/eprint/59775

Actions (login required)

Перегляд елементу