Search

The purpose of this article is to develop a model for an access control policy and to formulate a method for creating a model of information security threat scenarios in industrial control system (ICS). The results of developing an access control policy model based on role assignment are presented. This model encompasses the information assets derived from the analysis of technological processes ˗ access objects that are vital for the functioning of the industrial network. In addition to that a specific and refined list of personnel access subjects ˗ responsible for maintaining production technological processes within the ICS context is provided. Furthermore, a hierarchy of user roles has been constructed, wherein the role of a super user, possessing all privileges, has been excluded, and an access differentiation matrix has been developed. The model can be utilized in the development of a customized access differentiation policy within the scope of administrative policies of information security. The article formulates a way for EPC-modelling of scenarios depicting the implementation of information security threats. These scenarios outline the stages of complex multi-component attacks targeting the objects of the ICS. It depicts situations where cybercriminals infiltrate the external subnet ˗ the enterprise network ˗ and subsequently penetrate the internal industrial network, violating access management policies. An example illustrating the construction of a threat scenario targeting an OPC-server based on EPC-model is provided. This example delineates the tactics and techniques employed by cybercriminals, leading to the realization of a security incident from the Threats Data Bank. The method for constructing scenarios enables the visual representation of the sequence of actions undertaken by attacker. This sequence involves the exploitation of vulnerabilities and techniques, as well as the resultant events that influence the progression of the attack. SIEM (Security Information and Event Management) can be constructed to detect sequences of events identified using EPC-modeling. Therefore, the developed scenarios will contribute to timely detection and appropriate response during the early stages of cyberattack implementation.

The paper analyzes the features of the experimental evaluation of the single event effects (SEE) cross section dependence on linear energy transfer (LET) for ions with energies above 100 MeV/nucleon. Ion energy degraders use in order to change the values of the LET. The paper presents calculations of LET spectrum at different thicknesses of a polycarbonate degrader for iron ions with energies of 100...450 MeV/nucleon as an example. It is proposed to evaluate the LET values in packaged electronic devices with an unknown physical and chemical composition with help of the modified technique used at the ion accelerator at Brookhaven National Laboratory in the USA. An additional technique with preliminary studies on X-ray of packaged electronic is proposed to estimate the mass thickness of the protective layers in integrated circuit. In order to reduce the influence of infamous factors, it is proposed to thin the package based on the results of the analysis of X-ray images. The proposed approach makes it possible to correctly determine the dependence of the SEE cross sections on the LET of both packaged and decapsulated integrated circuits for SEE under high-energy ions. The obtained results are supposed to be used at the specialized ISKRA station, which is part of the NICA nuclotron complex at JINR, Dubna. The presented results make it possible to assess the upset and failure hardness of electronic information systems to the effects of ions of artificial and natural origin.

This study explores the prevalent issue of non-compliance with information security policies (ISPs) within organizations, offering a way by which organizations can monitor non-compliance of ISPs using a practical suggested approach. By crowdsourcing artificial intelligence (AI) driven algorithms from a well-known and popular public site and applying the Design Science Research (DSR) approach, this work offers a way that organizations can monitor non-compliance in real-time with the proposed AI-driven algorithm prompting behavior that fosters better compliance. The research integrates principles embedded in the Theory of Planned Behavior (TPB) into two algorithms, with results showing that algorithm 2, which applies a binary classification model, generates prompts that are more efficient in eliciting desired compliance than algorithm 1. The study's practical significance lies in the crowdsourcing appeal, where readily available and cost-effective resources may reach ordinary organizations. The study contributes to the field by exploring AI-driven algorithms, crowdsourcing and addressing user attitudes, subjective norms, and perceived behavioral control challenges. The study concludes by acknowledging limitations, proposing future research directions, and highlighting its valuable contribution to understanding and addressing non-compliant behavior.

The article develops a functional model of unauthorized access (UA) protection mechanisms at information infrastructure objects (IIOs). It defines the content of protection measures, techniques used, and stages of their implementation. It substantiates the order of execution of individual functional components of the structural representation of the objective function "Protection of information of IIOs from UA". The sequence of implementation of these components is illustrated as a change in the states of the Markov process for constructing such a model. A table is provided of the correspondence between the list of procedures performed by an intruder in the process of implementing an UA threat to information of an IIOs and the procedures for protecting information, and it demonstrates the possibility of transition from the description of information protection measures from UA at IIOs in terms of functional modeling to the mathematical representation of the time characteristics of the functional components of the objective function of protection. The corresponding analytical expressions are provided for various options for representing the order of the functional components performed.

Problem description. One of the areas of digital transformation of Russian society is the development and implementation of the National Digital Ruble System (DR) in the credit and financial sphere (CFS) of the economy of the Russian Federation. The National DR system should be based on the information technology infrastructure (ITI) for ensuring information security (IS). In fact, the ITI for ensuring IS is a trust infrastructure (ITIT) based on the public key infrastructure (PKI). ITIT should have a number of functional properties, including identification and authenti­cation of objects and subjects of electronic financial transactions, protection of the integrity and confidentiality of data and the electronic financial transactions themselves, implementation of the principle of non-repudiation of the parties to information interaction. At the same time, the absence of ITIT in the National DR System can completely discredit the very idea of digitalization of the CFS, associated with the absence of any guarantees of reliability and trust in the National DR System, based on the implementation of the entire range of methods and means of cryptographic protection of information (electronic financial transactions), including systems for managing cryptographic keys. The absence of comprehensive protection of the National DR System will entail risks and problems in ensuring IS, which can negatively affect individuals, groups, organizations, sectors of the economy and society as a whole. Goals. To propose and analyze a heuristic model of DR and a model of functional and structural ITIT, which solves the main problems of ensuring IS of the National DR System, associated primarily with confirmation of the authenticity and ownership of DR, as well as the protection of electronic payment transactions and the possibility of withdrawing (withdrawing from circulation) DR immediately (on-line) after detection of its compromise. Results. The article presents a heuristic (hypothetical) model of C₽ and describes the DR format (as an information object) that includes cryptographically linked information blocks and public key certificates issued by accredited certification authorities using electronic signatures. A functional and structural model of the ITIT of the National DR System is proposed. The composition, main elements of the ITIT structure, as well as their goals and implemented functions are described. The results of the analysis of trust assurance based on the PKI of the Bank of Russia (BR) are presented. Practical significance. The heuristic (hypothetical) model of DR, the functional and structural model of the ITIT of the National DR System and the results of the analysis of trust assurance based on the PKI of the BR are of great practical significance in the development and implementation of the National DR System in the CFS of the Russian Federation economy. Conclusions. The results obtained will increase the level of security and trust in the National DR System of the citizens, businesses and credit and financial institutions.

Computer systems (CS) security has become a very critical concern that needs the attention of researchers to ensure the information protection and cyber security. This article provides an overview of the state of the art in cyber security, challenges, and global trends of CS security. A promising direction in solving information security problems is the use of stochastic methods based on the use of pseudo-random number generators (PRNG), the result of which is the introduction of unpredictability into the operation of CS and their elements. Examples of using stochastic methods for protection and attack are considered. Examples of information security technologies based on the use of PRNG in the development of software and hardware are given. Attention is drawn to the emergence of new mechanisms for carrying out attacks on CS based on code reuse and, accordingly, new methods of protection against such attacks. The idea of creating a stochastic computer is substantiated, and presented the possible strategies and approaches.

In the process of developing and operating navigation systems, it is very important to reliably assess the accuracy of determining spatial characteristics. A methodology has been developed for assessing and confirming the accuracy of determining spatial characteristics by various software and hardware systems, such as coordinates, velocity, and orientation. The basis was taken from the foreign standard ASTM E3064-16, which describes coordinates and orientation accuracy confirmation of optical tracking systems. The developed approach is based on assessing the accuracy of measuring a certain fixed length (rod) in different positions and orientations. The speed accuracy assessment is based on the coordinate accuracy assessment and is based on the use of linear regression to calculate the speed. The error in determining the orientation angle in space is also calculated based on the coordinate measurement error and is given for small angles. The applicability limits of the described methodology are given. The technique makes it possible to assess the accuracy and reliability of navigation and measuring systems.

The article identifies the main problems associated with the inconsistency and incoordination of such concepts as “information protection”, “information security”, “security of information”, “cybersecurity” and “cyber resilience”, which has led to the absence of a unified system currently accepted by the professional community concepts of the subject area under consideration. To overcome this flaw, it is proposed to build a basic system of concepts for the “security of objects in the information sphere (ISF)” subject area, based on taking into account the characteristics of objects (which using information technologies and processing information), using the ISF concept (as a collection of space of such objects and the environment of their interaction) and on the asset concept (part of an object that has a certain value), which can be main and auxiliary. Taking into account these initial data, the selected subject area is compared with three separate systems of concepts: “ensuring the security of information of objects in the ISF”, “ensuring the resilience of objects in the ISF” and “ensuring the information and psychological security of a person as an object’s asset in the ISF”. A description of the proposed systems of concepts is given, which can be attributed to the development of a methodological basis for ensuring the objects’ security. These conceptual systems have minimal overlap with each other and correspond to three separate areas of practical and scientific activity that require professionals with unique professional competencies. The results of the work have practical significance for the educational field in the formation of students' modern, methodologically sound conceptual base.

The article is devoted to the problem of identifying deviant groups studying in educational institutions. The article substantiates the relevance of this problem. Recent incidents and possible reasons for their occurrence are analysed. The system for preventive detection of deviant groups of teenagers is offered. Categories of deviant groups of adolescents are identified: potential shooters; potential bullies; potential students capable of laying hands on themselves. It is suggested to measure anxiety and aggressiveness in adolescents in order to detect deviation of adolescents. The ways of measuring anxiety and aggressiveness are considered. It is suggested to use profiling as an objective method of assessment. Profiling by school psychologists is rather difficult to implement due to their limited number in educational institutions. To automate the process and exclude the subjective factor, it is suggested to use online profiling. Within the framework of online profiling, the objects of research are the pages of social networks used by students. Criteria for determining anxiety and aggressiveness based on information from social network pages are proposed. A toolkit for partial automation of the process of data collection from the pages of social networks of students of educational institutions is proposed. The use of the method of clustering k-means clustering method to identify deviant groups of students. An example of detection of teenagers with deviations using specially generated synthetic data is given.

The ultra-high frequency (UHF) tag IC’s main part of the power management unit (PMU) design technique is presented. The technique is a step-by-step algorithm for designing a PMU and consists of five interrelated stages. At the first stage, the requirements for the parameters of the PMU (output voltage, output DC power, efficiency, output capacitor capacity) and the Q-factor of the tag analog front-end are determinates. At the second stage, the design of an electrical circuit of a voltage multiplier (VM) is carried out. VM is required to convert the voltage of the input radio frequency (RF) signal into an DC voltage. During the third stage, the design of the electrical circuit of the DC voltage limiter is carried out, which is necessary to reduce the output voltage of VM to a safe level. The result of stage 4 is an electrical circuit of surge protection designed to provide the required level of immunity of the tag IC to the effects of electrostatic discharge and a high-power RF signal. As part of the final stage, the evaluation and alignment with the required Q-factor value of the tag IC analog front-end is carried out. The proposed technique can be used for the development of domestic UHF tag ICs (ISO 18000-6C, GJB 7377.1, etc.) based on CMOS technological processes, including ICs designed for radio frequency identification of critical infrastructure objects. Using the presented technique, the design of a PMU with an estimated efficiency value of 70%, an estimated Q-factor of the analog front-end of less than 15 at an RF input signal power of -12.7 dBm was performed.

The purpose of the article is to develop a technique that allows analyzing and quantifying the software protection level used in automated systems of internal affairs agencies in real time. To achieve this goal, the method of system analysis of existing approaches to assessing the protection level of automated systems software, the mathematical apparatus of queuing systems, methods of graph theory, probability theory and mathematical statistics, and the theory of semi-Markov processes were used. Quantitative static and dynamic indicators are proposed that make it possible to adequately assess the software protection in relation to current vulnerabilities in the dynamics of its functioning and taking into account the existing disadvantages of operation at the facilities of informatization of internal affairs bodies. Mathematical models and algorithms for analytical calculation of the proposed indicators in real time have been developed. The prospects for the practical implementation of the considered technique are related to the development of a software package for analyzing and evaluating the software protection in order to select its optimal version for increasing the protection level of official information of limited distribution circulating at specific informatization facilities of internal affairs bodies.

Various approaches to solving the problem of speech command recognition in real time using artificial neural networks (ANN) of several types are considered. A brief overview of deep fully-connected, convolutional and recurrent neural networks is given. It is shown that ANNs of convolutional and recurrent types are capable of providing the required level of performance and accuracy when performing inference in real time. A comparison is given of the performance of convolutional and recurrent algorithms when ported to the K1879VM6Ya hardware platform from the NeuroMatrix family of high-performance digital signal processors. When porting, the features of the microprocessor architecture were considered. All basic operations are performed on a vector matrix coprocessor. The advantage of convolutional ANN has been demonstrated. Considering the results of research into a neural network of this type on the K1879VM6Ya platform, it was transferred to a more productive hardware accelerator - the K1879VM8Ya system-on-chip. The prospects for creating a speech recognition system on the K1879VM8Ya platform are considered.

The article presents the main provisions of the theory of functional modeling in relation to solving an important and relevant problem for the methodology of information security managing – the development of mathematical models characterizing the dynamic capabilities of malware to implement destructive effects on critical information infrastructure objects. As a result of the analysis of the models that pose a threat to information security through the use of malicious codes, such as the "chain of cyber intrusions", the "unified chain of cyber intrusions", the basic and advanced models of Diamond intrusion analysis, the ATT&CK model, an up-to-date version of the functional model in the IDEF0 notation of the process of malware destructive impact on the operating environment of a special-purpose automated control system was built. The process of malware exposure is decomposed into individual stages, tactics, and techniques. The purpose of the research was to develop a variant of the malware impact on a special-purpose automated control system as a method of violating the state of information security and its processes of the system under consideration. The obtained results are a tool for the formalized presentation of the described processes in terms of the Markov processes and the development of analytical models, appropriate temporal and probabilistic characteristics for quantitative assessment of the intruder's ability to implement threats to the information security state in special-purpose automated control systems, through the malware impact.

Striking a balance between safety and performance remains a critical concern, despite advancements in the field. To address this issue, a versatile framework named Safety Goes Along with Performance (SGAWP) is proposed, centered on off-policy algorithms grounded in value function optimization. SGAWP utilizes reinforcement learning to navigate the data space, emphasizing high task performance while addressing risks (such as undesirable states) by incorporating safety costs into the value function. By integrating uncertainty management and task performance constraints, SGAWP aims to achieve improved safety performance alongside respectable task performance. Moreover, SGAWP leverages curiosity-driven exploration to expand the data space and employs task policies to enhance safety policy performance. As a result, SGAWP enhances safety performance with minimal loss in task performance. Beyond its success in reinforcement learning, SGAWP holds promise for applications like autonomous driving, where safety is paramount. Through rigorous experimentation across various off-policy algorithms, SGAWP demonstrates robust generalization and achieves its objectives effectively.

The article substantiates the key role anti-virus protection of automated control systems in ensuring the required protection level of information circulating and processed in these systems. A scientific hypothesis is formulated on ways to solve the problem adaptive control of the process ensure information protection in the automated control system from effects of impact of malware as a problem increasing the efficiency information support for these systems in the process of their functioning. The factors influencing the controllability of information security in the automated control system against threats from malware are formulated. The general form of expressions for characterizing the capabilities of an information protection violator, resident anti-virus protection technology in automated control systems and information processing technology in these systems is substantiated, as well as the general form of expression for the indicator of information protection controllability of in automated control systems from the effects of malware.

The article is focused on the development of a method for detecting and eliminating floating vulnerabilities in mobile applications, their nature is described, and existing methods of detecting and neutralizing floating vulnerabilities are investigated, their defects are noted. The developed method is based on analyzing the state of the application at different points in time and comparing it with a reference state. The proposed algorithm includes fixing the initial state, discrete analysis, detection and identification of vulnerabilities, their elimination, and prevention of additional risks. The scope of application of the results includes the developing and securing of mobile applications for Android operating system. The conclusions of the paper confirm the importance of detecting and preventing floating vulnerabilities to ensure a high level of information protection. The developed method allows to effectively detect and eliminate vulnerabilities, which contributes to the creation of secure and protected applications for users of mobile devices.

The article is devoted to the formalization of the process of unauthorized getting of computer information by intercepting informative signals of secondary electromagnetic radiation of the main technical means and systems by technical means of intelligence, as well as the removal informative guidance signals on the conductive lines of the main technical means by technical means of intelligence. Analyzing the completeness problem of the assessing information leakage threats due to the interception of informative signals of side electromagnetic radiation and leads, it must be stated that the procedure for identifying such threats is limited only to their detection by controlling only individual signs of manifestations of these threats. At the same time, the dynamics of the interception implementation process is not taken into account. This determines the need to solve the scientific problem of developing methodological foundations for the synthesis of algorithms for recognizing information leakage threats. The article presents the main stages of the procedure for formalizing the actions of the violator to intercept information. The basis for solving such problems is the procedure for forming the recognition feature space. In order to form such a space, functional modeling methods are used. The article presents a representation of the functional diagram in terms of the Markov process, as well as obtaining a mathematical expression to determine the average value of the time spent by the violator to achieve the target interception function.

Circuit solutions for physically unclonable functions (PUF) of a ring oscillator (RO) implementation for the purposes of digital devices identification, cryptographic keys and random numbers generation are considered. The effectiveness using configurable ROs (CROs) in PUF circuits is based not only on reducing of the hardware overhead of traditional RO PUFs, but also on the generation of output signals with unique frequencies, close in value in a case of the FPGA implementation. The proposed modification of the basic scheme of the CRO PUF, based on the XOR2 logic gates as controlled delay elements, allows to use a full set of input challenges instead of the basic scheme. It is shown that the delay value depends not only on the challenge, but also on the interconnect configuration of the structural elements of the CRO circuit. A time model of the modified CRO PUF is proposed, which analytically proves the influence of interconnects on the frequency of the generated signal, which was experimentally confirmed using the Xilinx Zynq-7000 FPGA. Based on this result, a new structure of PUF CRO with controlled interconnections is proposed.

This article discusses the development of recommendations for shielding individual parts of a technical means to reduce the energy of the signal emitted by the LVDS (Low Voltage Differential Signaling) interface. The LVDS interface is widely used in various electronic devices for transmitting low-voltage digital signals. In fact, LVDS became an interface for connecting laptops and monitor arrays, for this reason it is used in a large number of standard LCD panels. However, when signals are transmitted through the LVDS interface, side electromagnetic radiation occurs, which can be intercepted by intruders. To solve this problem, it is proposed to use the shielding recommendations described in this article. Shielding is the process of installing a metal shield that serves as a barrier to electromagnetic radiation around the cable, the technical means itself or its separate parts. This allows to reduce the level of signal emission and improve the quality of data transmission. The article describes methods for individual parts of a typical monitor with an LVDS interface shielding. Special attention is paid to evaluating the effectiveness of the proposed recommendation. Experiments are being carried out, during which the radiation level of the signal is measured before and after the refinement of the technical means. The results show a significant decrease in signal energy, which confirms the effectiveness of the proposed approach. Thus, this article is of interest to specialists in the field of electronics and engineers involved in the development and improvement of data transmission interfaces. The proposed recommendations can be used to reduce electromagnetic radiation in various electronic devices with LVDS interface.

Due to the growing popularity of the Internet of Things concept and the increasing number of information security incidents affecting cyber-physical systems, the issue of managing the protection of information processed and stored in such systems is becoming especially relevant. Violation of the integrity, confidentiality, and availability of this information can lead to leakage of personal data, trade secrets, as well as disruption of the cyber-physical system, which can affect the life safety of its users. “Smart Home” is one of the types of cyber-physical systems, where wireless communication channels are widely used for data transmission. Such channels are vulnerable to remote attacks. It leads to the fact that additional cybersecurity measures must put in place. The article discusses the most popular protocols of local wireless data transmission channels in cyber-physical smart home systems, such as Wi-Fi, Bluetooth Low Energy, Zigbee. An analysis of their security level conducted. For each protocol, methods for organizing channel protection at different levels Internet-architecture as well as known vulnerabilities are described. In order to demonstrate the process of ensuring cybersecurity of Internet of Things systems, an experimental model of a cyber-physical smart home system was proposed. Using the model as an example, recommendations are given for the improving cybersecurity of wireless communications in such systems. The process of taking into account cryptographic capabilities of the different hardware platforms is described. These recommendations can be applied to the Internet of Things and smart home systems in order to increase their cybersecurity.

The departmental personnel training system of the Ministry of Internal Affairs of Russia has significant experience in training specialists in various educational programs in the field of information security. Over the past decade, due to various factors, significant changes have taken place in this area, particularly in its state regulation based directive provisions for the Russian Information Security Doctrine. And they have also given a new impetus to the actualization and adaptation of these changes in existing educational programs. Such work is being carried out «on a broad front» by Russian universities subordinate to the Ministry of Education and Science of the Russian Federation, within the framework of the Educational and Methodological Association of the same name. There is also an obvious need to solve this problem at the departmental level, in particular, within the framework of the personnel training system of the Ministry of Internal Affairs of Russia. This paper presents the results of the pre-design survey, which is a part of the relevant educational programs developed on the basis of federal educational standards. Based on this survey, it is planned to further develop and implement measures to improve the quality of training in the field of managing information infrastructure security for Russian internal affairs authorities. The object of the study is to improve the quality of this process in the field of managing the security of the information for the Department of Internal Affairs. In order to achieve qualification requirements for certain categories within the internal affairs bodies, the article examines the domestic experience of leading Russian and international universities in educational training of specialists in the field of information security. The basis for the formulation of proposals for the modernization of the variable part of educational programs for the training of specialists in the protection of the information infrastructure of internal affairs authorities is the experience of designing domestic professional standards for the protection of information and individual foreign initiatives.

The possibility of increasing the effectiveness of the use of the so-called biosignature due to the transfer in its composition of an expanded set of bioparameters characterizing the functional and psycho-emotional state of the author of the document at the time of its signing or approval is shown. Analysis of the entire set of bioparameters transmitted as part of the biosignature, as well as their comparison with similar individual parameters characteristic of the author’s normal working and calm state, makes it possible to identify cases of his inappropriate behavior, including obtaining a signature under duress or under the influence of narcotic substances. Along with such bioparameters as heart rate, blood pressure, and pupillary response, the study examines the possibility of recording hand tremor. This informative indicator allows you to assess the level of nervous tension of the author of the document, and also makes it possible to identify a number of diseases of the author, which may also be a reason for declaring the document incompetent. The study examines the possibility of using a fitness bracelet to record hand tremor. Experimental studies have shown that hand tremor recorded by accelerometers and a gyroscope, usually included in the fitness bracelet, can be measured with good accuracy by these gadgets, taking into account the level of their own noise. The advantage of the considered approach is also that the fitness bracelet, as a rule, is constantly on the hand, which makes it possible to register the bioparameters of the author at the time of working with the document. The use of cell phones, smartphones and other wearable devices for this purpose is not always possible, since at the time of signing or approving the document, the author most likely does not hold them in his hand and places them on the table.

Trust (in reliable and safe operation) in a microelectronics product is mainly «laid down» at the stage of its development and is managed by guarantees of quality and reliability, the developer's qualifications and experience, a rational choice of key technical solutions that implement specified functional and operational characteristics, as well as parrying the main threats to its safety. Similarly, trust in products during their pilot and mass production is managed by the results of effective interaction and a rational combination of two systems: (1) managing the quality and protection of the manufacturer of products (i.e., using trusted processes) and (2) controlling production batches and samples of finished products (i.e., checking the reliability of a complex of technical means). This interaction implements a mutual «transfer of trust» to production processes and finished products – the possibility of spreading trust in production processes to trust in finished products and vice versa. At the stage of mass production, it is necessary first of all to ensure the stability of functional and operational characteristics, as well as acceptable technical and economic indicators of the product while maintaining the quality and protection levels inherent in its development. The article presents the results of an analysis of the critical stages of the microelectronics products production, typical threats arising at these stages, and methods of their parrying. There results allow us to build trust in such products (trust in their reliability and quality).

This article addresses the privacy issue in distributed ledger technology (DLT) and blockchain. The research focuses on the applied use case of private transactions involving digital assets. The article provides a comparison of various privacy methods, including mixing networks, ring signatures, and off-chain protocols. It is noted that these methods do not achieve the target level of decentralization, which is a crucial property for blockchain. To address these limitations, the article introduces zero-knowledge proof methods, with a particular emphasis on SNARK. Mathematical descriptions of SNARK methods are presented, along with software implementation approaches. The research includes experiments conducted to compare the performance and information security properties of SNARK methods in the use case of private transactions involving digital assets. The experimental results highlight approaches to improve performance using batch verification methods. The findings of this research have practical implications for the development of systems requiring high levels of privacy and decentralization in blockchain-based systems.

The purpose of the study was to analyze possible methods for determining the attack surface in relation to solving the problem of fuzzing testing the kernel of operating systems of the Linux family and selecting the most suitable one. To evaluate and compare various models and practical approaches to attack surface analysis, as well as assess the possibility of combining them, theoretical research methods such as analysis, comparison, and deduction were used. Existing models and approaches to analyzing the attack surface of the Linux kernel are assessed and compared. A solution is proposed for the practical determination of the attack surface for effective testing of the kernel using the fuzzing method, which combines the studied approaches. The results of the study can be used to practically construct an attack surface, which will allow us to more accurately determine the goals of fuzz testing of the Linux kernel.

The purpose of the article is to identify clear directions and mechanisms for the creation of software manufacturing factories in the Russian Federation. This issue has become especially relevant during the period of sanctions pressure on our country. Accordingly, one of the tasks of the ball is the need to determine which factories (repositories) are available in the Russian Federation (primarily for creating system software as a basic basis for other types of software) and the criteria according to which one or another repository can be classified as technologically independent from foreign repositories and distributions. At the same time, attention is drawn to the fact that the system software product created in this repository should not only have one or another functionality, but also consumer qualities necessary for a huge number of users and developers not only in the Russian Federation, but also in the world. In this article, in our opinion, it was possible to clearly define the need to create repositories in the country not as repositories of certain packages and libraries used for the production of software products, but as a distributed development infrastructure with the ability to build, support, store and verify source code, software packages and libraries located on the territory and in the jurisdiction In the Russian Federation, technologically independent of foreign repositories and distributions. The results of the scientific research should be applied in the preparation of normative legal acts of the Russian Federation defining the principles and criteria for the creation of software products used in the functioning of the critical information infrastructure of the Russian Federation, as well as the information infrastructure of military and public administration.

At the current stage of information technology development, a key trend is the use of machine learning algorithms in the information security field. The relevance of our research is determined by the importance of identifying vulnerabilities and the potential of machine learning to enhance modern cybersecurity management software. Moreover, there is an evident demand for security mechanisms for critical infrastructure organizations, including in the context of import substitution needs. Our study focuses on examining a dataset formed from data obtained from the firewall about the remote connection between a remote user and an organization's VPN server. Thus, it seems reasonable to explore the possibilities of expanding the functionality with a User and Entity Behavior Analytics (UEBA) module when working with firewalls. The research goal is to analyze methods of detecting atypical user behavior, with the prospect of using the developed model in a behavioral analysis module integrated into the firewall. The primary material for the study is information collected from the firewall about the start and end events of user remote sessions to the organization's VPN server. The main research methods include the analysis of existing theoretical sources and practical recommendations, preprocessing of data, dimensionality reduction exploration, the use of the Isolation Forest model as an anomaly detection method, and the tuning of hyperparameters for this model. Particular attention is given to promising features for use in the proposed model. The theoretical significance of the research lies in the potential development of the employee profiling idea for building an organizational information security management system. From a practical standpoint, the article is relevant for professionals in the information security and machine learning fields.

The purpose of the article is analysis of approaches to build protecting information systems, that processed by computer equipment from leakage due to side electromagnetic radiations. The article analyzes the technical and economic indicators that determine the set of parameters that reflect the labor intensity of work to create a protected and certified informatization object according to the security of information requirements. The novelty of proposed approach lies on the analysis of spatial characteristics of the informatization object and calculation of labor intensity of the works of preparation and further certification of the computer object to the security of information requirements. Using the considered approach allows to determine the optimal of the chosen method of protection the computer equipment designed for processing protected information from leakage due to side electromagnetic radiations. The proposed method allows to evaluate the labor intensity of planned costs and material costs for implementation of preparation and certification of the informatization object. The relevant in practice is the comparison of considered approaches is presented for distributed objects of informatization, the computer equipment of which is placed in small areas inside dense urban development with small sizes of controlled area. For the specified objects the problem of oversaturation is the most acute not only by computer equipment, but also by electromagnetic noise generation, the excess of which may entail the problems with electromagnetic compatibility with the object’s wireless communication connections and the impact on the health and functional (performance) of employees.

Based on the previously accepted taxonomy of concepts, a classification of concepts is proposed that is related to cybersecurity (CS) of objects and currently has the maximum unambiguous correspondence between the terms denoting these concepts and the concepts themselves. When constructing the classification, an attempt was made to apply the fundamentals of the taxonomy theory (systematics), the results of which led to the conclusion that the considered structures of concept systems will be hierarchical (the basic principle of taxonomy) under certain conditions (for example, when using only concepts that relate to the categories of the subject (object)), process, or property). The approach considered made it possible to form a group of terms directly related to the concepts from the proposed classification. This set can be considered as a terminology system related to the object’s CS. The proposed terms and their definitions do not contradict similar ones being used, but are distinguished by consistency in relation to the terms (definitions) themselves and corresponding concepts, and also have a universal application, which allows their use for almost any CS objects related to information (for example, information and automated systems, informatization systems, sociotechnical systems, cyber-physical systems and information as an object). The results obtained also have practical significance for education in the formation of a modern, methodologically sound conceptual base of students.

The content of the main threat assessment stages of unauthorized access (UA) at critical information infrastructure (CII) facilities is determined on the basis of analysis of the primary provisions of the Methodology for Assessing Information Security Threats, approved on February 5, 2021 by the FSTEC of Russia. The ways to develop a methodology for assessing such information security threats are focused. A functionally-oriented approach is proposed to take into account the dynamics of the UA threat implementation regarding information of CII facilities. The procedure for constructing a functional model of the threat is considered in accordance with its existing structuring within the framework of the basic model of information security threats presented in the documents of the FSTEC of Russia. The decompositional hierarchical structure of the target threat function is substantiated as the first stage in constructing the model. The content of structure levels is given: the level of target threat function, the level of its implementation strategies, the level of tactics used, the level of the intruder’s action stages, and the level of procedures done to access the operating environment of the computer system (CS) and destructive impact on information. The execution sequence of individual functional components of this structure is determined as well as the order of their implementation is illustrated in the form of a change of states of the Markov process as the second stage of constructing the model. Based on this vision, the possibility of moving from a description of the UA threat to information of CII facilities in terms of functional modeling to a mathematical representation of the temporal characteristics of functional components of its target function is demonstrated. The corresponding analytical expressions are given for various options for representing the order of executed functional components.

Machine vision is a field of artificial intelligence that deals with processing images and videos using special algorithms. This allows devices to analyze visual information. Machine vision helps with tasks such as pattern recognition, image segmentation, object detection, and tracking. In microscopy, machine vision plays an important role, particularly in laser scanning microscopy (LSM). Laser scanning microscopy, laser scribing, and laser correction of the topology of semiconductor crystals are important technological processes in the production, control and adjustment of semiconductor crystals both on debug samples and as part of a test batch on a wafer. Laser exposure allows not only mechanically separate crystals, but also carry out more delicate and minimally invasive actions, in particular, adjustments to the values of thin-film resistors or burning of bridges necessary to adjust the circuit and disable unused blocks of the crystal. The paper lists the main parameters of the positioning system as part of the laser scanning setup, their impact on the quality of scanning and exposure to focused radiation at control points. The principles of machine vision algorithms when working with the image of the scanned object and the results of testing in the task of automated laser burning of bridges on a semiconductor wafer are described. Since the number of bridges can reach tens of thousands, and positioning systems have significant errors, machine vision allows you to correct the area and accuracy of laser exposure at any stage of scanning, which significantly improves the quality and efficiency of the process.