Search

One of the urgent tasks of information security (IS) is to predict the probabilities of IS threats to an organization that are implemented due to a computer attack (CA). Existing methodologies for assessing CA are Cyber Kill Chain, Mitre Att&ck, NIST 800-115, Certified Ethical Hacker (CEH), FSTEC of Russia and ISO 27001/ They offer approaches to the analysis of CA from the organization point of view. The article offers a completely new approach to CA predicting from the intruder point of view. The analysis of the CA from the intruder point of view is carried out. The methods of CA discussed by intruder s in the DarkNet and their structuring are highlighted. The stages of the implementation of the SC from the intruder point of view are justified: theoretical training, practical training, achieving the goal of the CA. The conclusion about the possibility of using the mathematical apparatus of cellular automata in the simulation of the CA is justified, since the dynamics of the CA is similar to the dynamics of a cellular automaton. The parameters that affect the possibility of implementing the CA by the intruder are determined, in particular, the popularity of the CA method, the availability/sufficiency of means of protection against this CA, and others. The quantitative characteristics of the CA that determine the weighting factor of the transition (WCP) are justified. The sufficiency of the list of selected quantitative characteristics of the CA is confirmed by the results of the analysis of the CA, implemented with the help of the malicious software Petya, on the nodes of the information infrastructure of organizations located on the territory of Ukraine.

An objective assessment of the level of protection of an organization’s information system provided by an appropriate information security system (ISS), both at the stage of its design and at the operation stage, is possible based on the use of estimates of current and predicted probabilities of computer attacks of intruder of this IS using vulnerabilities ISS. To assess the probability of a computer attack by an intruder, this study proposes to use the expected utility function that takes into account key attack criteria of the possibility of a computer attack (criteria for choosing an object of a computer attack by an intruder, stages and methods of implementing an attack, methods of obtaining information about an object, skills of an intruder) and the expected usefulness of the attack (motives the offender, the state of the offender before a computer attack, in particular, his income, the principles for deciding on the conduct / continuation / termination of a computer attack intruder), modernized taking into account the characteristics of this type and crimes in the computer sphere. The proposed solution is based on the theory of provisions in criminology, which states that an attack is implemented by an intruder in cases where it is possible to implement an attack and, at the same time, the expected utility of the attack from the point of view of the offender is sufficient. It is demonstrated that the selected utility function adequately describes the relationship between the probability of a computer attack and the key attack criteria of a computer attack. The analysis of the modernized utility function, the results of which showed that: 1) the value of the expected utility, ceteris paribus, for the offender prone to risk, is determined by the probability of exposing it (which is equivalent to the likelihood of an inconspicuous computer attack), for the offender not prone to risk, - the severity of the punishment, therefore it is necessary to build a differentiated protection system depending on the type of intruder; 2) there is the possibility of a significant reduction in the number of potential violators by increasing revenues from the legal activities of security experts; 3) there is a dependence of the number of computer attacks for a certain period of time on the probability of an inconspicuous computer attack, the severity of the punishment, the presence and magnitude of alternative income (benefits).

The paper presents the results of study about the influence of the initial weights choice on the long-term forecast accuracy in the problem of multi-step forecast with a neural network based on long short-term memory (LSTM-net) for time series, composed of time-ordered samples of a harmonic, an amplitude-modulated signal and a frequency-modulated signal. The recursive forecast has been estimated on model time series data providing the means to measure the actual accuracy of the forecast while controlling influence of different characteristics. The analysis of the results show that a necessary condition for obtaining a high-quality long-term forecast is the correct choice of the LSTM-net parameters, especially the initialization of weights for neural network layers. At the same time the use of LSTM-net parameters, which provide high accuracy of short-term forecast, does not guarantee the accuracy of the long-term forecast, and vice-versa. In this regard it is concluded that the usage of other forecast methods and /or algorithms for correcting predicted values for mentioned types of time series is preferable.

The paper presents the concept of a model for managing access to virtual memory in a Linux-based operating system (OS). The concept is developed based on the analysis of approaches to memory management in the Linux-based OS. The model of process access control to virtual memory areas is justified and is based on the consideration of the process as the subject of access, and the area of virtual memory used by this process as the object of access (accordingly, the virtual memory of the process is a set of virtual memory areas). To implement this model in practice, it is proposed to use the permission flags of virtual memory areas. The proposed model can be an addition to the mandatory entity-role model of access and information flows security control in Linux-based OS or other standard models, where the subject is a user or process, and the object is a file.