Designing a decision support system for the weakly formalized problems in the provision of cybersecurity

Abstract

When complex situations of the guaranteed provision of OBCP IS arise, the decision-making process should be performed under condition of active interaction with experts; in this case, such an operation proves to be rather labor consuming without computer technologies. Even the initial problem of designing the integrated systems for information protection (ISIP) can be attributed to the weakly formalized problems with incomplete information. Similar tasks include the situations, connected with the recognition of prolonged targeted cyberattacks, which are not distinguished by explicit attributes. Therefore, the subject of the study that addresses the development of models and software (SW) of DSS in the weakly structured and difficult-to-formalize tasks in the provision of OBCP IS appears relevant. Literature review and problem statementAn increase in the number of cyberattacks on MCCS in recent years has generated interest towards the development IntroductionIn connection with the growing number of complex targeted cyberattacks directed at the mission critical computer systems (MCCS), one of the vital problems of society is the information security (IS) and its component -cybersecurity (CS). When conducting targeted attacks, cybercriminals frequently are used unique harmful programs and methods of penetrating the MCCS (objects of cyberprotection -OBCP). Resisting a constant increase in the complexity of illegitimate actions on MCCS is possible, in particular, using the systems for the intelligent recognition of cyberattacks (SIRCA), equipped with the modules for decision support system (DSS). The architecture of the latter implies, as a rule, a system for intelligent data analysis (SIDA or Data Mining). SIRCA make it possible to reveal regularities in the dynamics of development of the OBCP states, combining the knowledge and experience of decision making by experts, as well as the SIDA computational potential. INFORMATION TECHNOLOGY DESIGNING A DECISION SUPPORT SYSTEM FOR THE WEAKLY FORMALIZED PROBLEMS IN THE PROVISION OF CYBERSECURITY B . A k h m e t o v Y . B o i k oAssociate Professor Department of Information Technology Security* E-mail: julia_boyko2010@ukr.net A . M i s h c h e n k oAssociate Professor Department of Information Security Protection* E-mail: partpravo@i.ua *National Aviation University Kosmonavta Komarova ave., 1, Kyiv, Ukraine, 03058Розроблено систему підтримки при-йняття рішень (СППР) в слабко форма-лізуємих завданнях забезпечення кібер-безпеки. Система базується на моделях опису завдань кіберзахисту в понятійно-му і функціональному аспектах. Описано процес формування бази знань СППР для обставин, пов'язаних з виявленням важко пояснюваних ознак аномалій та атак. Запропонована СППР дозволяє підвищи-ти розуміння ситуації, яка підлягає ана-лізу в процесі кіберзахисту комп'ютерних систем Ключові слова: система підтримки прийняття рішень, кібербезпека, слабо формалізовані завдання, інтерпретація ситуації Разработана система поддержки при-нятия решений (СППР) в слабо формали-зуемых задачах обес...

Development of a system for the detection of cyber attacks based on the clustering and formation of reference deviations of attributes

“…As a criterion of the optimization of parameters, during ASR learning, we used statistical parameters (information measures) for the variants of solutions with two alternatives [18,25,26] for a modified entropic indicator, as well as the Kullback-Leibler divergence (for three hypotheses) [27]. Table 1 Stages of splitting FS into clusters…”

Adaptive Decision Support Systems for Cyber Security

“…decision-making and decision-making processes are based not only on quantitative characteristics, but also on factors that do not always have quantitative measures (psychological, moral, etc.) [20];…”

Management of information protection based on the integrated implementation of decision support systems

“…In the process of project implementation, a critical part of development as a whole is the correct definition of the problemmanagement of protection of informatization objects on the basis of integrated implementation of decision support systems on cybersecurity. The approaches, analyzed in [1][2][3][4][5], aimed at providing cybersecurity of IO, which imply extensive build-up of means and activities on IP, do not always guarantee reliable protection. Expert systems, including adaptive [4,8,14], and DSS do not eliminate the need for antivirus software, intrusion detection systems, etc.…”

“…The approaches, analyzed in [1][2][3][4][5], aimed at providing cybersecurity of IO, which imply extensive build-up of means and activities on IP, do not always guarantee reliable protection. Expert systems, including adaptive [4,8,14], and DSS do not eliminate the need for antivirus software, intrusion detection systems, etc. However, in the complex situations on IO cyber security in which the outcome of the task depends on subjective knowledge, the effect of their implementation into integrated IPS is sufficiently high.…”

“…Thus, a new promising alternative direction emerges for providing IO CS based on employing intelligent information technologies of cyber defense. Such technologies include decision support systems (DSS) for IP and CS [4]. The relevance of present study is determined, above all, by the state of problems in IP and the management level of CS under conditions of growing number and complexity of intentional destructive attacks on the enterprises' ICS.…”