Model synthesizer for cyberattack monitoring systems

Abstract

Abstract. The paper describes a method of monitoring the security status of local corporate networks, which combines the processes of synthesis and analysis of input behavior patterns, prediction of their values and modeling of cyberattacks. Model-classifiers of cyber threats have been created. Characteristics of data flows come into the network with the help of sensors installed in advance scheduled trace points of the computer network. There is a classification of vectors from the indicators that characterize these cyber attacks. The obtained results are presented both quantitatively and qualitatively, in accordance with the basic provisions of the theory of complex systems. In order to increase the efficiency of network protection, it was proposed to centralize computational process using grid infrastructure and cloud platform. A preliminary comparison of grid and cloud technologies has been carried out. The workload and computationally complicated procedure is transferred from local computer networks to high-performance environments. Using simulation models, it was investigated changes in the state of the query processing scheme, based on a sample of attacks that came to computer systems. The model takes into account heterogeneous input data flows and the possibility of changing the intensity of requests in information systems by attackers, which allows choosing ways to counteract and neutralize the effects of their impact, and analyze more complex cyberattacks. With the help of simulation models, the dynamics of changes in the conditions of the subsystem blocking queries in the process of recognition of cyber attacks in critical computer systems is researched. In addition to cybersecurity, accelerating the task of multiple recognition is relevant to many other important applications, such as intelligent data analysis, accelerated processing of XML queries, QoS technology management, IP-telephony filtering, caching optimization, etc.