Модель виявлення багатопрофільних загроз нульового дня в умовах обмежених ресурсів

Formulation of the problem in general. Based on an examination of extant methodologies for detecting multi-profile zero-day threats under martial law conditions characterized by inadequate funding, infrastructure, and expertise, an innovative multi-tiered detection model is proposed. This model integrates preliminary filtering, behavioral analysis, and localized self-learning mechanisms to enhance responsiveness to cyber threats within resource-constrained environments. Research methods. A comprehensive set of theoretical and applied research methods was employed in the course of this study. The theoretical component included analysing and synthesising scientific literature, which enabled the systematisation of existing approaches to zero-day threat detection and identifying their strengths and limitations under resource-constrained conditions. A comparative analysis evaluated the effectiveness of conventional and advanced cyber defence methods based on key criteria such as resource dependence, operational autonomy, and detection accuracy. Among the applied methods, behavioural modelling was utilised to design the foundational structure of a system capable of identifying anomalous activity. To validate the proposed model, computer-based experimentation was conducted, assessing the performance of anomaly detection algorithms - specifically, the autoencoder and Isolation Forest - within a simulated, isolated environment. Furthermore, modelling and prototyping techniques formed the basis for developing an adaptive heuristic monitoring architecture and constructing a multi-level framework for real-time anomaly detection. This methodological framework facilitated a detailed examination of the operational characteristics of the proposed models in low-resource environments, assessed their zero-day threat detection accuracy compared to traditional methods, and supported the implementation of a simulation-based experiment. Literature review. Recent research on detecting multi-profile zero-day threats demonstrates significant progress in applying behavioural analysis, effectively reducing reliance on signature-based detection methods. Scientific studies have examined various approaches for identifying zero-day threats, including signature-based detection, behavioural analysis, vulnerability analysis of program code, and machine learning techniques. This body of research highlights the ongoing need for further investigation into detection methods tailored explicitly to resource-constrained environments, conditions that are particularly characteristic of periods of military conflict. Research results. As a result of the conducted research, a comprehensive analysis of contemporary approaches to detecting multi-profile zero-day threats was performed, with particular consideration given to the operational characteristics of information systems under martial law conditions and limited resources. The study identified key limitations of traditional cybersecurity tools – specifically Security Information and Event Management (SIEM) systems – which demonstrate reduced effectiveness in isolated environments lacking sufficient computational resources and qualified personnel. A novel authorial model for zero-day threat detection was developed in response to these challenges. The proposed model integrates preliminary traffic filtering, behavioural analysis, and localised self-learning through lightweight anomaly classification algorithms, including autoencoders and the Isolation Forest method. The model was formalised as a multi-level architecture capable of autonomous functioning, local adaptation, and real-time response to anomalous activities. A new concept of adaptive heuristic monitoring was introduced, enabling the identification of potential zero-day vulnerability exploitation without prior knowledge of specific threat signatures. Additionally, a risk-based process isolation mechanism was formulated, temporarily suspending potentially malicious actions while maintaining the continuity of critical system functions. Experimental model validation was conducted under conditions simulating a realistic cyber conflict environment. The results confirmed the model's high accuracy in detecting diverse anomaly profiles while maintaining a low false positive rate – even when deployed on outdated or low-performance hardware. These findings demonstrate the model's applicability for cybersecurity systems operating under military conflict, resource constraints, or autonomous deployment, thereby significantly enhancing the resilience of critical information infrastructure. Research novelty. The model proposed in the study is a multi-level system that integrates preliminary filtering, behavioural analysis, and local self-learning. This design enables the implementation of effective response strategies to unknown threats, even under constrained operational conditions. As a result, the model can function on outdated hardware, accumulate local experience, and adapt to changes in the behaviour of potential threats without compromising operational efficiency. Theoretical and practical significance. The study presents a scientifically grounded approach to evaluating traditional cyber defence tools in resource-constrained environments, where operational autonomy, rapid response, and minimal dependence on external update sources are critically important. The practical significance of the research lies in the potential application of the proposed model to implement a hybrid strategy that integrates the strengths of multiple detection methods. This approach enables the development of a multi-level, flexible, and scalable cybersecurity framework, capable of providing reliable protection against zero-day threats even under limited resources. Conclusions and future work. The proposed hybrid approach, which integrates the advantages of multiple detection methods, enables the implementation of a multi-level, flexible, and scalable cybersecurity framework. Future research will be directed toward developing neural network models with long-term memory capabilities to enhance adaptability to emerging behavioural anomalies. In addition, efforts will focus on designing a multi-agent architecture that supports the decentralised exchange of generalised detection patterns between nodes, thereby eliminating the need for a centralised control system.