The method of classification of user and system data based on the attributes

The paper presents method of classification of user and system data based on the attributes. The method is intended to solve the problem of data classification in the internal audit of computer equipment with a large volume of data stored on the media. The parametric space of informative features for the classification task is defined. To conduct internal audit of computer technologies in order to analyze the information security incidents we need data related directly with the user's action. While OS data are considered a priori as legitimate. With the growing volume of stored and processed information there is a need for accurate classification of user and system data to ensure that expert is analyzing only the information that can attribute itself with the information security incident. Thus, carrying out classification with high precision, it is possible to reduce the probability of the expert error during the internal audit of large amounts of data of operating system and application software. The method consists of several stages. The first stage involves the collecting of samples out of virtual machines running the Windows 10 operating system. Then the attributes of data stored on the hard disk are retrieved. Further, the received set of attributes is written to a “csv” file with a specific structure. On the final stage the informativity of features for further classification of files to user or system is determined. This method has the potential for development and showed its applicability in tasks of data classification to user or system. The feature informativity for accurate classification was identified. The comparison of three classification algorithms was carried out and the Naive Bayes classifier was selected. The method can be used not only in tasks of internal audit of computer equipment under the influence of information security violation threats, but for the purpose of computer forensics, which is investigation of information security incidents.