The article presents the method of forming associative rules from the database of the SIEM system... more The article presents the method of forming associative rules from the database of the SIEM system for detecting cyber incidents, which is based on the theory of fuzzy sets and methods of data mining. On the basis of the conducted analysis, a conclusion was made about the expediency of detecting cyber incidents in special information and communication systems (SICS) by applying ruleoriented methods. The necessity of applying data mining technologies, in particular, methods of forming associative rules to supplement the knowledge base (KB) of the SIEM system with the aim of improving its characteristics in the process of detecting cyber incidents, is substantiated. For the effective application of cyber incident detection models built on the basis of the theory of fuzzy sets, the use of fuzzy associative rule search methods is proposed, which allow processing heterogeneous data about cyber incidents and are transparent for perception. The mathematical apparatus for forming fuzzy associative rules is considered and examples of its application are given. In order to increase the effectiveness of the methods of searching for fuzzy associative rules from the database of the SIEM it is proposed to use weighting coefficients of attributes that characterize the degree of manifestation of their importance in the fuzzy rule. A formal formulation of the problem of forming fuzzy associative rules with weighted attributes and which are used for the identification of cyber incidents is given. A scheme of their formation and application for identification of cyber incidents is proposed. The method of forming fuzzy associative rules with weighted attributes from the database of the SIEM is given. The problem of determining the weighting coefficients of the relative importance of SIEM system DB attributes is formulated and a method for its solution is proposed. The formulation of the problem of finding sets of elements that have a weighted fuzzy support of at least the given one and are used to form fuzzy associative rules with weighted attributes is given. Methods for its solution are proposed.
The information technology of analysis and determination of the political orientation of informat... more The information technology of analysis and determination of the political orientation of information sources on the Internet and social networks has been developed and proposed. Based on the application of the machine learning library and fastText text classification, a model was created to determine the political orientation of open information sources. Modules for scanning sources of open information on the Internet and social networks have been developed, which ensure the implementation of the following functions: the formation of databases by collecting information from specified information resources; setting up modules for automatic scanning of information from websites and social networks; full-text search; extracting entities from individual documents; determination of the political orientation of information sources. The practical significance of the obtained results lies in the creation of a working layout of the system for determining the political orientation of electron...
The author considers the creation of a Cybersecurity Situation Center (CSC), its tasks and compos... more The author considers the creation of a Cybersecurity Situation Center (CSC), its tasks and composition, and also provides the main technological tools that should be included in an effective CSC. Particular attention is paid to the information security incident management system (SIEM), which is key to the CSC, and its purpose and main tasks that it should solve are considered. The authors analyzes the peculiarities of solving the problem of rational selection of a SIEM. The groups of indicators characterizing the degree of fulfillment of the requirements for a SIEM are allocated and their examples are given. The use of fuzzy set theory for processing expert information on qualitative indicators characterizing a SIEM is proposed. The features related to making a rational decision on the choice of a SIEM are analyzed. Groups of indicators that can help in assessing the degree of compliance of a SIEM with the requirements are allocated, and examples of these indicators are given. In o...
The article deals with the levels, types and kinds of cyber-training and provides a generalized c... more The article deals with the levels, types and kinds of cyber-training and provides a generalized classification. Such types of cyber-training as Capture the Flag and Cyber Range (Red Team / Blue Team) are considered in detail. As a separate approach, the gamification of cybertraining in the form of board and computer games is highlighted and analyzed. Further promising areas of research in the field of organization and conduct of cyber-training are suggested.
CERN European Organization for Nuclear Research - Zenodo, Oct 26, 2021
The process of designing a cybersecurity situational center as a complex organizational and techn... more The process of designing a cybersecurity situational center as a complex organizational and technical system is considered. It is proposed to consider the problem of designing the cybersecurity situational center from a formal point of view, as a problem of a class of multi-criteria multi-parameter problems, and as an approach to solving it we chose the decomposition of the design process into separate stages using the methods of successive approximations. The main stages are highlighted and described, the principles of implementing a systematic approach to the design of cybersecurity situational center are formulated and disclosed. The formal statement of the problem of task distribution between the operational personnel of situation center is presented. Criteria for choosing the type of organizational structure of the cybersecurity situational center are formulated and described, and on their basis the choice of the matrix hierarchical structure for its implementation is substantiated. The performance indicators for assessing the functioning of the cybersecurity situational center and its organizational and technical structure are considered.
We propose objective methods of the semantic comparison of the business task description with doc... more We propose objective methods of the semantic comparison of the business task description with documents describing competencies of applicants. The advantages of qualifications describing through the triad of professional qualities – knowledge, skills and competencies – are demonstrated. Scientific novelty of this work deals with the use of atomic competencies as a main component of original ontological qualification model that becomes an instrument for solving of the complex scientific problem of qualification matching. The authors develop the original ontology that describe the high-level relations of employers and employees. This ontology can be integrated with domain and organizational ontologies that specialized these relations for some concrete task. Such approach can be useful for innovation domains (new or multidiscipline) where expert groups and formal specifications of professional skills stand on stage of formation. Information acquired from natural language documents that...
The article deals with the current, nowadays, issues of cyber defense of critical infrastructure,... more The article deals with the current, nowadays, issues of cyber defense of critical infrastructure, which are becoming increasingly important. Based on the analysis, it is concluded that the basis of building an effective cyber defense system is the use of information management and security event management (SIEM). The use of systems of this type allows not only to detect cyber security incidents, but also to predict them based on the accumulated data in the system. The proposed new architecture for a promising proactive smart SIEM, which, in addition to the traditional levels of data collection, management and analysis, includes the fourth level - the level of decision making and implementation. The implementation of the proposed architecture is possible through the development and application of new methods of normalization, filtering, classification, aggregation, correlation, prioritization and analysis of events and cyber security incidents, their consequences, generation of ...
У статті представлено огляд сучасного стану кібернетичного простору в контексті зростання випадкі... more У статті представлено огляд сучасного стану кібернетичного простору в контексті зростання випадків кіберзлочинності (масштабних кібернетичних атак, що набули широкого розголосу в Україні та світі). Наведено порівняльний аналіз основних існуючих програмних рішень запобігання вторгненням в інформаційно-телекомунікаційні мережі, які відкриті на основі загальнодоступних ліцензій. Наведено характеристики основних методів виявлення атак (вторгнень) та виділено їхні основні недоліки: відсутність адаптивності, стійкості та верифікованості, високий рівень помилкових спрацьовувань та пропусків кібернетичних атак, слабкі можливості щодо виявлення нових атак, відсутність можливості визначення атаки на її початкових етапах, практична відсутність можливості ідентифікації атакуючого й визначення цілі атаки, складність виявлення вторгнень у режимі реального часу, значне завантаження системи та слабка інтерпретація поточної ситуації. Запропоновано перспективні шляхи їх усунення, які ґрунтуються на з...
CERN European Organization for Nuclear Research - Zenodo, Dec 9, 2021
The method of applying a simulation model of a fuzzy cyberattack detection system is considered. ... more The method of applying a simulation model of a fuzzy cyberattack detection system is considered. The functional diagram of the simulation model is given. The block diagram of the simulation model is considered and the purpose of its elements is described. The main steps of using a simulation model for conducting an experimental study of evaluating the effectiveness of models and methods for detecting cyber attacks based on the theory of fuzzy sets and fuzzy inference are described. The procedure for generating initial data is given, the classes of cyberattacks to be detected are defined, the vectors of cyberattack features are identified, the parameters of the studied traffic are described, the types of membership functions are defined to formalize expert knowledge and represent it in the knowledge base in the form of fuzzy production rules. The issue of parametric adaptation of membership functions to clarify the subjective judgments of experts are considered. To implement the possibility of detecting polymorphic cyberattacks, the procedure for determining the required number of the most important features for each known class of cyberattacks, represented by fuzzy sets and linguistic variables that characterize them quite fully, is described. A comparative analysis of the results of modeling the process of detecting cyber attacks based on the proposed approach with existing methods for detecting cyber attacks was carried out, based on the theory of fuzzy sets and fuzzy logic, artificial immune systems and neural networks in terms of accuracy.
The article describes the analysis of distribution for information resource when functioning ACS ... more The article describes the analysis of distribution for information resource when functioning ACS of a special purpose. The variable size of information units is considered. The formulated task is classified as the task of nonlinear programming. On the basis of the carried out analysis the decision method is offered. It is the most expedient to use a Lagrangian multiplier method in this case. The initial task is considered as the task of the conditional optimization. The method transforms the initial task to the task without restrictions. This problem is solved by methods of unconditional optimization. Application of a Lagrangian multiplier method for the solution of an objective has a row of features. The method is applied to the decision the task of nonlinear integer programming. Additional check is added to a method. During the decision of the task for a point which suitable for an extremum are checked execution of sufficient conditions. It provides a splitting of nonoptimal decis...
Information security is a dynamic field in which methods and means of protection against threats ... more Information security is a dynamic field in which methods and means of protection against threats and their destructive component are rapidly changing and improving, which is a challenge for organizations and society as a whole. Therefore, information systems related to cybersecurity require a constant flow of knowledge from internal and external sources, the volume of which is constantly growing. The introduction of big data sets in the field of cybersecurity provides opportunities for application for the analysis of data containing structured and unstructured data. The application of semantic technologies to search, selection of external big data, and description of knowledge about the cybersecurity domain require new approaches, methods, and algorithms of big data analysis. For selecting relevant data, we are offered a semantic analysis of metadata that accompanies big data and the construction of ontologies that formalize knowledge about metadata, cybersecurity, and the problem t...
The paper proposes and substantiates approaches to building a corporate system for monitoring and... more The paper proposes and substantiates approaches to building a corporate system for monitoring and analyzing social media on cybersecurity issues, which are based on the concept Big Data, Data/Text Mining, Information Extraction, Complex Networks, and Cloud Computing. The components of Elastic Stack technology, Sphinx information retrieval system, Graph Data Base Management System Neo4j, and Gephi graph analysis system are examined in detail. The main idea of a system for analyzing large amounts of data on cybersecurity issues from social media is the simultaneous application of methods and means of information retrieval, data analysis, and aggregation of information flows. The system should ensure the implementation of the following functions: the formation of databases by collecting information from certain information resources; settings for automatic scanning and primary processing of information from websites and social networks; maintaining full-text information databases; iden...
The article is devoted to the actual task of protecting information-telecommunication systems and... more The article is devoted to the actual task of protecting information-telecommunication systems and networks from cyber attacks in the conditions of their constant development and polymorphizm of malicious software. The analysis is carried out and a conclusion is made about the expediency of using models of anomaly identification that simultaneously operate with qualitative and quantitative data and are based on the mathematical theory of fuzzy sets and fuzzy logical inference. Specifically, an improved model for the detection of anomalies in the work of information and telecommunication systems and networks is presented, which is a further development of the previously proposed anomaly detection model based on fuzzy sets and fuzzy logic inference. The essence of the improvement is the introduction of weight coefficients for fuzzy rules that describe the anomalies that may arise during the operation of information and telecommunication systems and networks as a result of unauthorized ...
the paper proposes a way to represent tasks as components of programs based on the architecture o... more the paper proposes a way to represent tasks as components of programs based on the architecture of integral objects and using relational databases. The graphical, tabular and formulaic representation of the tasks, as well as the relational query language, are given as a means of expressing the tasks, which allows applying this approach both during design and for code generation to execute the tasks. The approach allows integrating a relational database model, functional business-logic of database and objects of the server application, as well as a user interface into a single presentation.
The article is devoted to the actual task of protecting information-telecommunication systems and... more The article is devoted to the actual task of protecting information-telecommunication systems and networks from cyber attacks in the conditions of their constant development and polymorphizm of malicious software. The analysis is carried out and a conclusion is made about the expediency of using models of anomaly identification that simultaneously operate with qualitative and quantitative data and are based on the mathematical theory of fuzzy sets and fuzzy logical inference. Specifically, an improved model for the detection of anomalies in the work of information and telecommunication systems and networks is presented, which is a further development of the previously proposed anomaly detection model based on fuzzy sets and fuzzy logic inference. The essence of the improvement is the introduction of weight coefficients for fuzzy rules that describe the anomalies that may arise during the operation of information and telecommunication systems and networks as a result of unauthorized ...
The article presents the method of forming associative rules from the database of the SIEM system... more The article presents the method of forming associative rules from the database of the SIEM system for detecting cyber incidents, which is based on the theory of fuzzy sets and methods of data mining. On the basis of the conducted analysis, a conclusion was made about the expediency of detecting cyber incidents in special information and communication systems (SICS) by applying ruleoriented methods. The necessity of applying data mining technologies, in particular, methods of forming associative rules to supplement the knowledge base (KB) of the SIEM system with the aim of improving its characteristics in the process of detecting cyber incidents, is substantiated. For the effective application of cyber incident detection models built on the basis of the theory of fuzzy sets, the use of fuzzy associative rule search methods is proposed, which allow processing heterogeneous data about cyber incidents and are transparent for perception. The mathematical apparatus for forming fuzzy associative rules is considered and examples of its application are given. In order to increase the effectiveness of the methods of searching for fuzzy associative rules from the database of the SIEM it is proposed to use weighting coefficients of attributes that characterize the degree of manifestation of their importance in the fuzzy rule. A formal formulation of the problem of forming fuzzy associative rules with weighted attributes and which are used for the identification of cyber incidents is given. A scheme of their formation and application for identification of cyber incidents is proposed. The method of forming fuzzy associative rules with weighted attributes from the database of the SIEM is given. The problem of determining the weighting coefficients of the relative importance of SIEM system DB attributes is formulated and a method for its solution is proposed. The formulation of the problem of finding sets of elements that have a weighted fuzzy support of at least the given one and are used to form fuzzy associative rules with weighted attributes is given. Methods for its solution are proposed.
The information technology of analysis and determination of the political orientation of informat... more The information technology of analysis and determination of the political orientation of information sources on the Internet and social networks has been developed and proposed. Based on the application of the machine learning library and fastText text classification, a model was created to determine the political orientation of open information sources. Modules for scanning sources of open information on the Internet and social networks have been developed, which ensure the implementation of the following functions: the formation of databases by collecting information from specified information resources; setting up modules for automatic scanning of information from websites and social networks; full-text search; extracting entities from individual documents; determination of the political orientation of information sources. The practical significance of the obtained results lies in the creation of a working layout of the system for determining the political orientation of electron...
The author considers the creation of a Cybersecurity Situation Center (CSC), its tasks and compos... more The author considers the creation of a Cybersecurity Situation Center (CSC), its tasks and composition, and also provides the main technological tools that should be included in an effective CSC. Particular attention is paid to the information security incident management system (SIEM), which is key to the CSC, and its purpose and main tasks that it should solve are considered. The authors analyzes the peculiarities of solving the problem of rational selection of a SIEM. The groups of indicators characterizing the degree of fulfillment of the requirements for a SIEM are allocated and their examples are given. The use of fuzzy set theory for processing expert information on qualitative indicators characterizing a SIEM is proposed. The features related to making a rational decision on the choice of a SIEM are analyzed. Groups of indicators that can help in assessing the degree of compliance of a SIEM with the requirements are allocated, and examples of these indicators are given. In o...
The article deals with the levels, types and kinds of cyber-training and provides a generalized c... more The article deals with the levels, types and kinds of cyber-training and provides a generalized classification. Such types of cyber-training as Capture the Flag and Cyber Range (Red Team / Blue Team) are considered in detail. As a separate approach, the gamification of cybertraining in the form of board and computer games is highlighted and analyzed. Further promising areas of research in the field of organization and conduct of cyber-training are suggested.
CERN European Organization for Nuclear Research - Zenodo, Oct 26, 2021
The process of designing a cybersecurity situational center as a complex organizational and techn... more The process of designing a cybersecurity situational center as a complex organizational and technical system is considered. It is proposed to consider the problem of designing the cybersecurity situational center from a formal point of view, as a problem of a class of multi-criteria multi-parameter problems, and as an approach to solving it we chose the decomposition of the design process into separate stages using the methods of successive approximations. The main stages are highlighted and described, the principles of implementing a systematic approach to the design of cybersecurity situational center are formulated and disclosed. The formal statement of the problem of task distribution between the operational personnel of situation center is presented. Criteria for choosing the type of organizational structure of the cybersecurity situational center are formulated and described, and on their basis the choice of the matrix hierarchical structure for its implementation is substantiated. The performance indicators for assessing the functioning of the cybersecurity situational center and its organizational and technical structure are considered.
We propose objective methods of the semantic comparison of the business task description with doc... more We propose objective methods of the semantic comparison of the business task description with documents describing competencies of applicants. The advantages of qualifications describing through the triad of professional qualities – knowledge, skills and competencies – are demonstrated. Scientific novelty of this work deals with the use of atomic competencies as a main component of original ontological qualification model that becomes an instrument for solving of the complex scientific problem of qualification matching. The authors develop the original ontology that describe the high-level relations of employers and employees. This ontology can be integrated with domain and organizational ontologies that specialized these relations for some concrete task. Such approach can be useful for innovation domains (new or multidiscipline) where expert groups and formal specifications of professional skills stand on stage of formation. Information acquired from natural language documents that...
The article deals with the current, nowadays, issues of cyber defense of critical infrastructure,... more The article deals with the current, nowadays, issues of cyber defense of critical infrastructure, which are becoming increasingly important. Based on the analysis, it is concluded that the basis of building an effective cyber defense system is the use of information management and security event management (SIEM). The use of systems of this type allows not only to detect cyber security incidents, but also to predict them based on the accumulated data in the system. The proposed new architecture for a promising proactive smart SIEM, which, in addition to the traditional levels of data collection, management and analysis, includes the fourth level - the level of decision making and implementation. The implementation of the proposed architecture is possible through the development and application of new methods of normalization, filtering, classification, aggregation, correlation, prioritization and analysis of events and cyber security incidents, their consequences, generation of ...
У статті представлено огляд сучасного стану кібернетичного простору в контексті зростання випадкі... more У статті представлено огляд сучасного стану кібернетичного простору в контексті зростання випадків кіберзлочинності (масштабних кібернетичних атак, що набули широкого розголосу в Україні та світі). Наведено порівняльний аналіз основних існуючих програмних рішень запобігання вторгненням в інформаційно-телекомунікаційні мережі, які відкриті на основі загальнодоступних ліцензій. Наведено характеристики основних методів виявлення атак (вторгнень) та виділено їхні основні недоліки: відсутність адаптивності, стійкості та верифікованості, високий рівень помилкових спрацьовувань та пропусків кібернетичних атак, слабкі можливості щодо виявлення нових атак, відсутність можливості визначення атаки на її початкових етапах, практична відсутність можливості ідентифікації атакуючого й визначення цілі атаки, складність виявлення вторгнень у режимі реального часу, значне завантаження системи та слабка інтерпретація поточної ситуації. Запропоновано перспективні шляхи їх усунення, які ґрунтуються на з...
CERN European Organization for Nuclear Research - Zenodo, Dec 9, 2021
The method of applying a simulation model of a fuzzy cyberattack detection system is considered. ... more The method of applying a simulation model of a fuzzy cyberattack detection system is considered. The functional diagram of the simulation model is given. The block diagram of the simulation model is considered and the purpose of its elements is described. The main steps of using a simulation model for conducting an experimental study of evaluating the effectiveness of models and methods for detecting cyber attacks based on the theory of fuzzy sets and fuzzy inference are described. The procedure for generating initial data is given, the classes of cyberattacks to be detected are defined, the vectors of cyberattack features are identified, the parameters of the studied traffic are described, the types of membership functions are defined to formalize expert knowledge and represent it in the knowledge base in the form of fuzzy production rules. The issue of parametric adaptation of membership functions to clarify the subjective judgments of experts are considered. To implement the possibility of detecting polymorphic cyberattacks, the procedure for determining the required number of the most important features for each known class of cyberattacks, represented by fuzzy sets and linguistic variables that characterize them quite fully, is described. A comparative analysis of the results of modeling the process of detecting cyber attacks based on the proposed approach with existing methods for detecting cyber attacks was carried out, based on the theory of fuzzy sets and fuzzy logic, artificial immune systems and neural networks in terms of accuracy.
The article describes the analysis of distribution for information resource when functioning ACS ... more The article describes the analysis of distribution for information resource when functioning ACS of a special purpose. The variable size of information units is considered. The formulated task is classified as the task of nonlinear programming. On the basis of the carried out analysis the decision method is offered. It is the most expedient to use a Lagrangian multiplier method in this case. The initial task is considered as the task of the conditional optimization. The method transforms the initial task to the task without restrictions. This problem is solved by methods of unconditional optimization. Application of a Lagrangian multiplier method for the solution of an objective has a row of features. The method is applied to the decision the task of nonlinear integer programming. Additional check is added to a method. During the decision of the task for a point which suitable for an extremum are checked execution of sufficient conditions. It provides a splitting of nonoptimal decis...
Information security is a dynamic field in which methods and means of protection against threats ... more Information security is a dynamic field in which methods and means of protection against threats and their destructive component are rapidly changing and improving, which is a challenge for organizations and society as a whole. Therefore, information systems related to cybersecurity require a constant flow of knowledge from internal and external sources, the volume of which is constantly growing. The introduction of big data sets in the field of cybersecurity provides opportunities for application for the analysis of data containing structured and unstructured data. The application of semantic technologies to search, selection of external big data, and description of knowledge about the cybersecurity domain require new approaches, methods, and algorithms of big data analysis. For selecting relevant data, we are offered a semantic analysis of metadata that accompanies big data and the construction of ontologies that formalize knowledge about metadata, cybersecurity, and the problem t...
The paper proposes and substantiates approaches to building a corporate system for monitoring and... more The paper proposes and substantiates approaches to building a corporate system for monitoring and analyzing social media on cybersecurity issues, which are based on the concept Big Data, Data/Text Mining, Information Extraction, Complex Networks, and Cloud Computing. The components of Elastic Stack technology, Sphinx information retrieval system, Graph Data Base Management System Neo4j, and Gephi graph analysis system are examined in detail. The main idea of a system for analyzing large amounts of data on cybersecurity issues from social media is the simultaneous application of methods and means of information retrieval, data analysis, and aggregation of information flows. The system should ensure the implementation of the following functions: the formation of databases by collecting information from certain information resources; settings for automatic scanning and primary processing of information from websites and social networks; maintaining full-text information databases; iden...
The article is devoted to the actual task of protecting information-telecommunication systems and... more The article is devoted to the actual task of protecting information-telecommunication systems and networks from cyber attacks in the conditions of their constant development and polymorphizm of malicious software. The analysis is carried out and a conclusion is made about the expediency of using models of anomaly identification that simultaneously operate with qualitative and quantitative data and are based on the mathematical theory of fuzzy sets and fuzzy logical inference. Specifically, an improved model for the detection of anomalies in the work of information and telecommunication systems and networks is presented, which is a further development of the previously proposed anomaly detection model based on fuzzy sets and fuzzy logic inference. The essence of the improvement is the introduction of weight coefficients for fuzzy rules that describe the anomalies that may arise during the operation of information and telecommunication systems and networks as a result of unauthorized ...
the paper proposes a way to represent tasks as components of programs based on the architecture o... more the paper proposes a way to represent tasks as components of programs based on the architecture of integral objects and using relational databases. The graphical, tabular and formulaic representation of the tasks, as well as the relational query language, are given as a means of expressing the tasks, which allows applying this approach both during design and for code generation to execute the tasks. The approach allows integrating a relational database model, functional business-logic of database and objects of the server application, as well as a user interface into a single presentation.
The article is devoted to the actual task of protecting information-telecommunication systems and... more The article is devoted to the actual task of protecting information-telecommunication systems and networks from cyber attacks in the conditions of their constant development and polymorphizm of malicious software. The analysis is carried out and a conclusion is made about the expediency of using models of anomaly identification that simultaneously operate with qualitative and quantitative data and are based on the mathematical theory of fuzzy sets and fuzzy logical inference. Specifically, an improved model for the detection of anomalies in the work of information and telecommunication systems and networks is presented, which is a further development of the previously proposed anomaly detection model based on fuzzy sets and fuzzy logic inference. The essence of the improvement is the introduction of weight coefficients for fuzzy rules that describe the anomalies that may arise during the operation of information and telecommunication systems and networks as a result of unauthorized ...
Uploads
Papers by Ihor Subach