ГРАФОВА МОДЕЛЬ КІБЕРБЕЗПЕКИ ІНФОРМАЦІЙНИХ РЕСУРСІВ

• Date: 2020
• Main Authors: Nesterenko, А.V., Netesin, I.E.
• Format: Article
• Language: English
• Published: V.M. Glushkov Institute of Cybernetics of NAS of Ukraine 2020
• Subjects: кібербезпека; інформаційні ресурси; загрози; ризик; онтології; графова модель
• Online Access: https://jais.net.ua/index.php/files/article/view/481
• Journal Title: Problems of Control and Informatics

With the growing activity of cyberattacks on automated information systems, the task of determining the priority of building protective equipment is becoming increasingly relevant. The model for solving this problem, based on the ontological description and graph representation of the system security environment, is proposed. The ontologies of threats, resources (objects) and protection mechanisms are developed. The proposed approach is based on construction and partitioning of the graph of the relations of threats and system objects into subgraphs (subsystems) as connected components of the original graph with subsequent finding the relative risks of the damage of these subsystems within the overall system in order to find out the subsystems should be given priority to increase their security level. The risks assessments of resources damage is determined on the basis of expert threat scores and expert scores of the level of harm (loss) from damage. The algorithm has been developed by which the relative risks of subsystems are calculated. Analytical expressions are given and the example is used to calculate the risks of damage of the objects for the system without the partition into subsystems and taking into account the partition, to detect critical subsystems for protection. Application of the model gives the clearer picture of the interaction of threats and system resources, helps to find the most significant vulnerabilities of the system and to look for ways to improve its security in the process of solving practical tasks to ensure cybersecurity. The performed calculations confirm the correctness and adequacy of the proposed model, its simplicity and ease of use, providing an effective tool for experts and developers of security systems for automated information systems.