Search

The development of technologies and computing resources not only expanded the spectrum of digital services in all areas of human activity, but also defined the spectrum of targeted cyber attacks. The object of the study is the process of ensuring the safety of critical business processes that ensure the continuity of production and/or functioning of the company/organization/enterprise as a whole. Targeted attacks are aimed at destroying not only the business structure, but also its individual components that determine critical business processes. Continuity of such business processes is a critical component of any company, organization or enterprise of any form of government, which critically affects the earning of profits or the organization of production processes. The proposed concept of determining the security level of critical business processes is based on the need to use multi-loop information protection systems. This allows to ensure the continuity of critical business processes through a timely objective assessment of the level of security and the timely formation of preventive measures. This approach is based on the proposed rules for determining the achievement of a given level of security, which are based on assessments of the integrity, availability and confidentiality of information arrays, as well as computer equipment in relation to various points of the organization's business processes. The use of threat integration on the internal and external contours of the protection system allows to ensure the necessary level of security and continuity of the production/technological process of critical business processes. The proposed practical implementation of the system security level assessment system in the declarative programming language Prolog, which allows to form requirements regarding the achievement of a given system security level depending on the state assessments of individual system components

The development of technologies and computing resources has not only expanded the range of digital services in all spheres of human activity, but also determined the range of targeted cyber attacks. Targeted attacks are aimed at destroying not only the business structure, but also its individual components that determine critical business processes. The continuity of such business processes is a critical component of any company, organization or enterprise of any form of ownership, which has a critical impact on making a profit or organizing production processes. The proposed concept of determining the security level of critical business processes is based on the need to use multiloop information security systems. This makes it possible to ensure the continuity of critical business processes through a timely objective assessment of the level of security and the timely formation of preventive measures. This approach is based on the proposed rules for determining the reach of a given security level, based on assessments of the integrity, availability and confidentiality of information arrays, as well as computer equipment for different points of the organization's business processes. The issues of applying situational management methods to ensure the safe functioning of objects of socio-cyberphysical systems, logical and transformational rules that form the foundation for building a situational type cybersecurity management system are considered. One of the main tasks of systems of this type is described– the task of replenishing the description of the situation. The use of pseudophysical logics, various types of pseudophysical logics, the method of their construction and their interconnection are proposed. Particular attention is paid to causal pseudophysical logic, as the least developed for the purposes of ensuring cybersecurity. The formation of smart technologies, as a rule, uses the wireless standards of communication channels IEEE 802.11X, IEEE 802.15.4, IEEE 802.16, which use only authentication protocols and privacy mechanisms that are formed on the basis of symmetric algorithms. In the conditions of the post-quantum period (the appearance of a full-scale quantum computer), the stability of such algorithms is questioned. Such systems, as a rule, are formed on the basis of the synthesis of socio-cyber-physical systems and cloud technologies, which simplifies the implementation of Advanced Persistent Threat attacks, both on the internal loop of control systems and on the external one. The proposed creation of multi-circuit information protection systems allows for an objective assessment of the flow state of the system as a whole and the formation of preventive measures against cyber threats. In the thied chapter, models of probable threats and information protection in public networks are proposed. The most general model of the formal description of the protection system is the model of the security system with full overlap, in which a complete list of protection objects and threats to information is determined, and means of ensuring security are determined from the point of view of their effectiveness and contribution to ensuring the security of the entire telecommunications system. It is also shown that the combination of four models (M1, M2, M3, M4) in various variants provides wide opportunities for modeling various known types of threats and their implementation. However, in connection with the continuity of the process of developing new and improving existing methods and means of implementing threats, it is necessary to use such approaches to ensuring information protection that allow detecting and preventing threats of unknown types and carrying out dynamic correction of protection behavior, adapting it to specific application conditions. The M5 basic model is described, which enables continuous refinement of threat classes and response measures, and continuous training of the adaptive component of the CSI, which, in turn, detects and prevents threats of unknown types. The M6 basic model is introduced with the aim of obtaining higher security due to the presence of a special module of internal diagnostics that diagnoses the entire protection system, decides on the correction of the SHI behavior algorithm, and makes it possible to achieve SHI fault tolerance; a special module that diagnoses the communication channel with subsequent changes in the level of protection, allows to achieve the adaptability of the SHI. The fourth chapter is deal with the development of cryptographic primitives based on cellular automata. The definition of a cellular automaton is given and the elementary rules of intercellular interaction are described. A number of generators of pseudorandom binary sequences have been developed based on a combination of elementary rules of intercellular interaction, as well as cell interaction according to a rule of our own development. In the “cryptographic sponge” architecture, a cryptographic hashing function with a shuffling function based on cellular automata was developed and its statistical characteristics and avalanche effect were investigated. A block cipher in the SP-network architecture is constructed, in which cellular automata are used to deploy the key, and the encryption process is based on elementary procedures of replacement and permutation. Substitution blocks are used from the well-known AES cipher, a description of a stream cipher is given, where a personal computer keyboard and mouse are used as the initial entropy. Random data received from the specified devices is processed by a proprietary hashing function based on a "cryptographic sponge". All developed cryptographic functions and primitives demonstrated good statistical characteristics and avalanche properties. The fifth chapter proposes a methodology for analyzing the quality of the mechanism for validating the identified vulnerabilities of a corporate network, which is based on integral equations that take into account the quantitative characteristics of the vulnerability validation mechanism under study at a certain point in time. This technique allows you to build the laws of distribution of quality indicators of the vulnerability validation process and quantify the quality of the mechanism for validating detected vulnerabilities, which allows you to monitor and control the validation of identified vulnerabilities in real time during active security analysis. A method is proposed for constructing a fuzzy knowledge base for making decisions when validating vulnerabilities of software and hardware platforms with an active analysis of the security of a target corporate network based on the use of fuzzy logic, which makes it possible to provide reliable information about the quality of the mechanism for validating vulnerabilities indirectly. The constructed knowledge base allows you to form decisive decision-making rules for the implementation of a particular attacking action, which allows you to develop expert systems to automate the decision-making process when validating the identified vulnerabilities of target information systems and networks. An improved method of automatic active security analysis is proposed, which, based on the synthesis of the proposed models, techniques and methods, allows, in contrast to the existing ones, to abstract from the conditions of dynamic changes in the environment, i.e. constant development of information technologies, which leads to an increase in the number of vulnerabilities and corresponding attack vectors, as well as an increase in ready-to-use exploits of vulnerabilities and their availability, and take into account only the quality parameters of the vulnerability validation process itself.

The results of developing post-quantum algorithms of McEliece and Niederreiter crypto-code constructs based on LDPC (Low-Density Parity-Check) codes are presented. With the rapid growth of computing capabilities of mobile technologies and the creation of wireless mesh and sensor networks, Internet of Things technologies, and smart technologies on their basis, information security is becoming an urgent problem. At the same time, there is a need to consider security in two circuits, internal (directly within the network infrastructure) and external (cloud technologies). In such conditions, it is necessary to integrate threats to both the internal and external security circuits. This allows you to take into account not only the hybridity and synergy of modern targeted threats, but also the level of significance (degree of secrecy) of information flows and information circulating in both the internal and external security circuits. The concept of building security based on two circuits is proposed. To ensure the security of wireless mobile channels, it is proposed to use McEliece and Niederreiter crypto-code constructs based on LDPC codes, which allows integration into the credibility technology of IEEE 802.15.4, IEEE 802.16 standards. This approach provides the required level of security services (confidentiality, integrity, authenticity) in a full-scale quantum computer. Practical security technologies based on the proposed crypto-code constructs, online IP telephony and the Smart Home system based on the use of an internal server are considered

The development of the social aspect of the world community is closely related to the expansion of the range of digital services in cyberspace. A special place in which social networks occupy. The world's leading states are conducting information operations in this environment to achieve geopolitical goals. Such processes are reflected in real social and political life. This makes it possible to influence not only the social groups of society, but also to ensure manipulation in political "games" in the conduct of hybrid wars. The simultaneous interaction of social factors, influencing factors, the presence of communities in social networks forms a full-fledged socio-cyber-physical system capable of integrating real and virtual interactions to manage regional communities. The article proposes a method for predicting the assessment of social mutual influence between “formal” and “informal” leaders and regional societies. The proposed models make it possible to form not only a forecast of the influence of agents, but also the interaction of various agents, taking into account their formal and informal influences, the use of administrative resources, political moods of the regional society. This approach allows dynamic modeling based on impact and relationship analysis. The presented results of simulation modeling do not contradict the results of opinion polls and make it possible to form a set of measures that can be aimed at overcoming the negative impact on the regional society of both individual “leaders” and political parties. Analysis of the simulation results allows to increase both the political and social stability of the regional society, helps to prevent conflict moods and contradictions.

The paper presents the results of the development of a method for assessing the security of cyber-physical systems based on the Lotka–Volterra model. Security models of cyber-physical systems are proposed: “predator–prey” taking into account the computing capabilities and focus of targeted cyberattacks, “predator–prey” taking into account the possible competition of attackers in relation to the “prey”, “predator–prey” taking into account the relationships between “prey species” and “predator species”, “predator–prey” taking into account the relationship between “prey species” and “predator species”. Based on the proposed approach, the coefficients of the Lotka–Volterra model α=0.39, β=0.32, γ=0.29, φ=0.27 were obtained, which take into account the synergy and hybridity of modern threats, funding for the formation and improvement of the protection system, and also allow determining the financial and computing capabilities of the attacker based on the identified threats. The proposed method for assessing the security of cyber-physical systems is based on the developed threat classifier, allows assessing the current security level and provides recommendations regarding the allocation of limited protection resources based on an expert assessment of known threats. This approach allows offline dynamic simulation, which makes it possible to timely determine attackers' capabilities and form preventive protection measures based on threat analysis. In the simulation, actual bases for assessing real threats and incidents in cyber-physical systems can be used, which allows an expert assessment of their impact on both individual security services and security components (cyber security, information security and security of information). The presented simulation results do not contradict the graphical results of the classical Lotka–Volterra model, which indicates the adequacy of the proposed approach for assessing the security of cyber-physical systems

In modern software, crypto-algorithms are widely used for both data encryption tasks, and authentication and integrity checks. There are well-known and proven crypto-algorithms. Their cryptoresistance is either mathematically proven or based on the need to solve a mathematically complex problem (factorization, discrete logarithm, etc.). On the other hand, in the computer world, information constantly appears about errors or «holes» in a particular program (including one that uses crypto-algorithms) or that it was broken (cracked). This creates distrust both in specific programs and in the possibility to protect something in general by cryptographic methods not only from special services, but also from ordinary hackers. A promising direction of research in this field is the implementation of a hybrid random number generator with two types of entropy sources in cryptosystems. The method and means of implementing a hybrid random number generator with two types of entropy sources: external – based on Zener diode noise and internal – based on the uncertainty state of the transistor-transistor logic structure are presented. One of the options for the practical implementation of a random number generator is presented, where two sources are used as a source of entropy: an external source – Zener diode noise and an internal source – the undefined state of the transistor-transistor logic structure. The functional diagram of the proposed random number generator with two types of entropy sources is given. The MATLAB/Simulink model of the proposed random number generator is built, the results of the statistical analysis of the generated random sequences by the NIST SP 800-22 test package are given.

The development of the IT industry and computing resources allows the formation of cyberphysical social systems (CPSS), which are the integration of wireless mobile and Internet technologies and the combination of the Internet of things with the technologies of cyberphysical systems. To build protection systems, while minimizing both computing and economic costs, various sets of security profiles are used, ensuring the continuity of critical business processes. To assess/compare the level of CPSS security, various assessment methods based on a set of metrics are generally used. Security metrics are tools for providing up-to-date information about the state of the security level, cost characteristics/parameters from both the defense and attack sides. However, the choice of such sets is not always the same/understandable to the average person. This, firstly, leads to the absence of a generally accepted and unambiguous definition, which means that one system is more secure than another. Secondly, it does not take into account the signs of synergy and hybridity of modern targeted attacks. Without this knowledge, it is impossible to show that the metric measures the security level objectively. Thirdly, there is no universal formal model for all metrics that could be used for rigorous analysis. The paper explores the possibility of defining a basic formal model (classifier) for analyzing security metrics. The proposed security assessment model takes into account not only the level of secrecy of information resources, the level of provision of security services, but also allows, based on the requirements put forward, forming the necessary set of security assessment metrics, taking into account the requirements for the continuity of business processes. The average value of the provision of security services to CPSS information resources is 0.99, with an average value of the security level of information resources of 0.8

The development of Industry 4.0 technologies is based on the rapid growth of the computing capabilities of mobile wireless technologies, which has made it possible to significantly expand the range of digital services and form a conglomeration of socio-cyber-physical systems and smart technologies. The First Section discusses the issues of building security systems based on the proposed Concept of multi-contour security systems, taking into account the hybridity and synergy of modern targeted cyber-attacks, their integration with social engineering methods. This approach not only increases the level of security, but also forms an objective approach to the use of post-quantum security mechanisms based on the proposed Lotka-Volterra models. The Second Section analyzes the features of the functioning of social Internet services and establishes their role in ensuring the information security of the state. An approach is proposed to identify signs of threats in the text content of social Internet services, which will allow to quickly respond to changing situations and effectively counteract such threats. A classifier of information security profiles of users of social Internet services has been developed to assess the level of their danger as potential participants in disinformation campaigns. A method for identifying and evaluating the information and psychological impact on user communities in services is proposed. Models of conflict interaction of user groups in social Internet services are considered on the example of civil movements. To effectively counter threats to information security of the state, it is proposed to use the concept of synergistic user interaction and self-organization processes in a virtual community. Particular attention is paid to countering the manipulation of public opinion in the decision-making process by users of social Internet services. The Third Section proposes a biometric security system that works to authenticate users based on a comparison of their fingerprints and certain templates stored in a biometric database. A method for determining the contour based on the passage of a curve and the filtering function of contour lines has been developed. The stage of skeletal identification is analyzed in detail. The Ateb-Gabor method with wave thinning has been developed. The performance of skeletal algorithms such as the Zhang-Suen thinning algorithm, the Hilditch algorithm, and the Ateb-Gabor method with wave decimation is analyzed. The presented results of experiments with biometric fingerprints based on the NIST Special Database 302 database showed the effectiveness of the proposed method. The software and firmware were developed using the Arduino Nano.

To effectively protect critical infrastructure facilities (CIF), it is important to understand the focus of cybersecurity efforts. The concept of building security systems based on a variety of models describing various CIF functioning aspects is presented. The development of the concept is presented as a sequence of solving the following tasks. The basic concepts related to cyberattacks on CIF were determined, which make it possible to outline the boundaries of the problem and determine the level of formalization of the modeling processes. The proposed threat model takes into account possible synergistic/emergent features of the integration of modern target threats and their hybridity. A unified threat base that does not depend on CIF was formed. The concept of modeling the CIF security system was developed based on models of various classes and levels. A method to determine attacker's capabilities was developed. A concept for assessing the CIF security was developed, which allows forming a unified threat base, assessing the signs of their synergy and hybridity, identifying critical CIF points, determining compliance with regulatory requirements and the state of the security system. The mathematical tool and a variety of basic models of the concept can be used for all CIFs, which makes it possible to unify preventive measures and increase the security level. It is proposed to use post-quantum cryptography algorithms on crypto-code structures to provide security services. The proposed mechanisms provide the required stability (230–235group operations), the rate of cryptographic transformation is comparable to block-symmetric ciphers (BSC) and reliability (Perr10–9–10–12)

The necessity of estimating the decrease in the accuracy of measuring the informative parameters of aradar signal in real conditions of its propagation and reflection has been substantiated. The results of the estimation determine the requirements for optimizing this measurement to achieve the required efficiency. A numerical analysis of the decrease in the accuracy of measuring the Doppler frequency of a coherent packet is presented, depending on the statistical characteristics of fluctuations of the initial phases of itsradio pulses. Expressions are given for calculating the fluctuation component of the measurement error ofradio pulse packet frequency for various coefficients of interpulse correlation of phase fluctuations. An assessment is made of the possibility of increasing the accuracy of Doppler frequency measurement, which can be ensured by statistical optimization of the algorithm fortime-frequency processing of a givenradar signal by taking into account its phase fluctuations. The conditions for the multiplicative influence of phase fluctuations ofradio pulses of the received packet are substantiated, which determine the efficiency of optimization of Doppler frequency measurement. Based on the results of the study, an optimization method for measuring the Doppler frequency of the packet taking into account fluctuations in the initial phases of itsradio pulses is proposed. The accuracy of Doppler frequency measurement under the influence of both the internal noise of theradar receiver and the correlated phase fluctuations of itsradio pulses is estimated. The efficiency of optimization of measuring the Doppler frequency of the packet is estimated taking into account fluctuations of the initial phases of itsradio pulses by means of computer simulation. It is proved that, under the influence of phase fluctuations, the accuracy of Doppler frequency measurement can be increased due to the performed optimization from 1.86 to 6.29times. This opens the way to improving the existing algorithms for measuring the highertime range derivatives to improve the quality of tracking complex maneuvering aerodynamic objects. This explains the importance and usefulness of the work for theradar theory.

Research on the development of methods for identifying signs of hidden manipulation (destructive information and psychological impact) in text messages that are published on Internet sites and distributed among users of social networks is relevant. One of the main problems in the development of these methods is the difficulty of formalizing the process of identifying signs of manipulation in text messages of social network agents. To do this, based on morphological synthesis, it is necessary to determine relevant indicators for analyzing text messages and criteria for making a decision about the presence of signs of manipulation in text messages. Based on morphological synthesis, a method for determining manipulation indicators in text messages was developed, taking into account the achievements of modern technologies of intelligent content analysis of text messages, machine learning methods, fuzzy logic and computational linguistics, which made it possible to reasonably determine a group of indicators for evaluating text messages for signs of manipulation. The stages of the method include evaluating the text message at the level of perception by the indicator of text readability, at the phonetic level by the indicator of emotional impact on the subconscious, at the graphic level by the indicator of text marking intensity, and calculating the integral indicator for making a decision about the presence of manipulation in the text message. Based on the proposed method, specialized software was developed that provided 13% greater accuracy in evaluating messages for manipulative impact compared to the known method of expert evaluations, which reduced the influence of the subjective factor on the evaluation result

The rapid development of computer technology, the emergence of modern cyber threats with signs of hybridity and synergy put forward strict requirements for the economic component of national security and especially the processes of ensuring the economy cybersecurity. The cybersecurity industry is trying to meet today's requirements by introducing new and more advanced security technologies and methods, but it is believed that such a universal approach is not enough. The study is devoted to resolving the objective contradiction between the growing practical requirements for an appropriate level of cybersecurity of business process contours while increasing the number and technological complexity of cybersecurity threats. Also the fact that threats acquire hybrid features on the one hand, and imperfection, and sometimes the lack of methodology for modeling the behavior of interacting agents of security systems should be taken into account. However, this does not allow timely prediction of future actions of attackers, and as a result, determining the required level of investment in security, which will provide the required level of cybersecurity. The paper proposes the Concept of modeling the behavior of interacting agents, the basis of which is a three-level structure of modeling the subjects and business processes of the contours of the organization and security system, based on modeling the behavior of antagonistic agents. The proposed methodology for modeling the behavior of interacting agents, which is based on the Concept of behavior of antagonistic agents, allows assessing and increasing the current level of security by reducing the number of hybrid threats by 1.76 times, which reduces losses by 1.65 times and increases the time for choosing threat counteraction means by reducing the time to identify threats online by 38 %

Innovative activity of universities and the formation of entrepreneur universities of the innovative type is one of the forms of integration of the higher education systems of countries into the world educational and scientific space, support of their competitiveness. Based on the separation of interaction between universities and the economy and society, an evolutionary model of the university’s interaction with stakeholders was developed. Understanding the new mission of universities made it possible to separate the dominants of activities of an innovative and active university (IAU), to develop a scheme of the interconnection of management processes and its basic functions. The authors’ interpretation of the IAU and the preconditions for constructing a corporate information and education system (CIES) was formed.Given the synergism and hybridity of modern cyber threats, the rise of corruption in the educational sphere, the Anti-corruption concept, which provides countering the elements of corruption and integrated hybrid threats through the construction of an adaptive information protection system (AIPS). The basis of corruption counteraction is the digital signature (DS) of the Key Certification Center (KCC) based on PKI (Public Key Infrastructure). To ensure the security of information resources (IR) of CIES, we proposed a model that makes it possible not only to take into consideration the synergy and hybridity of modern threats but also to form preventive anti-corruption measures. A model for providing anti-corruption measures that reflects the scenarios of the behavior of the participants of the corruption process and the anti-corruption bodies was developed. This makes it possible to assess the dynamics of the distribution of corruption deals over time and by the types of corruption to ensure the effective distribution of the university resources for anti-corruption activities, Инновационная деятельность вузов и формирования предпринимательских университетов инновационного типа является одной из форм интеграции систем высшего образования стран в мировое образовательно-научное пространство, поддержки их конкурентоспособности. На основе выделения спирали взаимодействия университетов с экономикой и социумом, разработана эволюционная модель взаимодействия университета со стейкхолдерами. Понимание новой миссии университетов позволило выделить доминанты деятельности инновационно-активного университета (ИАУ), разработать схему взаимосвязи процессов управления и его основных функций. Сформирована авторская трактовка ИАУ и предпосылки построения корпоративной информационно-образовательной системы (КИОС).Учитывая синергизм и гибридность современных киберугроз, рост коррупции в образовательной сфере, предложена Концепция противодействия коррупции, которая обеспечивает противодействие элементам коррупции и комплексированным гибридным угрозам на основе построения адаптивной системы защиты информации (АСЗИ). Базисом противодействия коррупции является цифровая подпись (ЦП) Центра сертификации ключей (ЦСК) на основе технологии PKI (Public Key Infrastructure). Для обеспечения безопасности информационных ресурсов (ИР) КИОС предложена модель, что позволяет не только учитывать синергизм и гибридность современных угроз, но и формировать превентивные меры противодействия. Разработана модель обеспечения противодействия коррупции, которая отражает сценарии поведения участников коррупционного процесса и органов противодействия. Это позволяет оценить динамику распределения коррупционных сделок во времени и по типам коррупции для обеспечения эффективного распределения ресурсов университета на мероприятия по противодействию коррупции, Інноваційна діяльність закладів вищої освіти (ЗВО) та формування підприємницьких університетів інноваційного типу є однією з форм інтеграції систем вищої освіти країн у світовий освітньо-науковий простір, підтримки їх конкурентоспроможності. На основі виділення спіралі взаємодії університетів з економікою і соціумом, розроблена еволюційна модель взаємодії університету зі стейкхолдерами. Розуміння нової місії університетів дозволило виділити домінанти діяльності інноваційно-активного університету (ІАУ), розробити схему взаємозв'язку процесів управління і його основних функцій. Сформовано авторське трактування ІАУ та передумови побудови корпоративної інформаційно-освітньої системи (КІОС).З огляду на синергізм і гібридність сучасних кіберзагроз, зростання корупції в освітній сфері, запропонована Концепція протидії корупції, що забезпечує протидію елементам корупції і комплексованим гібридним загрозам на основі адаптивної системи захисту інформації (АСЗІ). Базисом протидії корупції є цифровий підпис (ЦП) Центру сертифікації ключів (ЦСК) на основі технології PKI (Public Key Infrastructure). Для забезпечення безпеки інформаційних ресурсів (ІР) КІОС запропонована модель, що дозволяє не тільки враховувати синергізм та гібридність сучасних загроз, а й формувати превентивні заходи протидії їм. Розроблено модель забезпечення протидії корупції, яка відображає сценарії поведінки учасників корупційного процесу і органів протидії. Це дозволяє оцінити динаміку розподілу корупційних угод у часі і за типами корупції для забезпечення ефективного розподілу ресурсів університету на заходи з протидії корупції

The development of computer technology has determined the vector for the expansion of services based on the Internet and “G” technologies. The main requirements for modern services in the banking sector are security and reliability. At the same time, security is considered not only as ensuring the confidentiality and integrity of transactions, but also their authenticity. However, in the post-quantum period, US NIST specialists question the durability of modern means of providing basic security services based on symmetric and asymmetric cryptography algorithms. The increase in computing resources allows attackers to use modern threats in combination. Thus, there is a need to search for new and/or modify known algorithms for generating MAC (message authentication codes). In addition, the growth of services increases the amount of information that needs to be authenticated. Among the well-known hash algorithms, the hash functions of universal hashing are distinguished, which allow initially determining the number of collisions and their uniform distribution over the entire set of hash codes. Possibilities of modifying the cascade hashing algorithm UMAC (message authentication code based on universal hashing, universal MAC) based on the use of McEliece crypto-code construction on algebrogeometric (elliptic codes (EC), modified elliptic codes (MEC) and damaged codes (DC). This approach allows preserving the uniqueness property, in contrast to the classical UMAC scheme based on a block symmetric cipher (AES). The presented algorithms for evaluating the properties of universality and strict universality of hash codes make it possible to evaluate the security of the proposed hashing constructs based on universal hash functions, taking into account the preservation of the universality property

The emergence of a full-scale quantum computer questions the stability of almost all symmetric and asymmetric cryptography algorithms. At the same time, the rapid growth of computing resources of IT and “G” technologies contributes to an increase in attacks on information and communication (ICS) and cyberphysical systems (CPS). These systems are the core of modern critical cybernetic information systems (CCIS). In such conditions, the primary task of maintaining the required level of security is the classification of modern threats that are integrated with social engineering methods and acquire signs of synergy and hybridity. The paper proposes a synergistic model of threats to ICS/CPS, which takes into account the focus of threats on synergy and hybridity, and the combined impact of security components: information security (IS), cybersecurity (CS), security of information (SI). This approach allows developing methodological foundations for building a unified classifier of threats to cyberphysical systems, forming sets of critical threats, critical points in the ICS/CPS infrastructure elements, based on minimal computing, human and economic costs. The developed methodology for determining the category of an attacker allows systematizing an attacker and, based on the analysis of weighting factors, forming a matrix of correspondence between the capabilities of attackers of various categories and technical means of information security (TMIS). These actions significantly reduce the risk of an attack by certain categories of attackers and allow for planning in the formation of both the IS policy and the corresponding protection profiles

An approach is proposed for assessing the uneven use of information resources in the organization’s business processes. Formal representations of the organization’s business processes and security systems are presented, reflecting both business operations carried out in a certain sequence and information resources that ensure the implementation of the relevant business operations, the place of information resources in the general outline of business processes is indicated. The circuits of the security system business processes of and the business processes of the main object of modeling are considered, including both business processes for managing security and business processes for ensuring security management. The assessment of the non-uniform use of information resources in a business process scheme is based on the consistent construction of an information resource incidence matrix for individual business operations, a frequency relationship matrix reflecting the sharing of information resources, and a matrix of derivatives in a discrete formulation. The proposed approach is demonstrated on a conditional example containing both the notional costs of information resources and weighting factors of the importance of business operations that reflect their criticality in the general contour of business processes. Estimates obtained as a result of applying the approach make it possible to group information resources, focusing on the frequency of their joint use in the business processes, which ultimately makes it possible to justify the choice of information resources for protection against threats from cyber intruders.

A game-theoretic approach is presented, which claims to be a universal method for solving most problems in the field of cybersecurity. As arguments to confirm the superiority of game theory, mathematical validity and provability of the optimality of decisions made, unlike the widely used heuristics, the possibility of developing reliable protection based on analytical results, ensuring a timely response to cyberattacks in conditions of limited resources, as well as distributed nature of decision making are highlighted. The definitions of the basic concepts used in security tasks based on game-theoretic models are introduced. The features of the application of game theory methods in the field of cybersecurity are listed and the limitations of research in this area are formulated, namely: a restriction on game strategies, simultaneous moves of players in the behavior patterns of security system agents, uncertainty in the time the players take the move, uncertainty in the final goal of the enemy, unpredictability of further player moves, lack of players’ assessment of enemy resources. as well as its ultimate goals, the inability to timely assess the current state of the game. The game-theoretic models are aligned with the listed security problems, and the main solutions obtained as a result of using the corresponding models are also determined. Many methods of game theory have been formed, for each of which a relationship is determined between the game model, its scope, simulation result and security services that the method under consideration supports. The limitations of the classical representation of game theory models are determined, the need to overcome which follows from the requirements for providing basic security services. Such limitations include: the ability of the defender to detect attacks, the certainty of the probabilities of a change of state before the start of the game, the synchronism of the players’ moves, the inability to scale the model due to the size and complexity of the system under consideration. Models of the main tasks of the interaction of antagonistic agents of security systems have been developed. The resulting models made it possible to obtain solutions to two of the most common tasks in the field of cybersecurity, namely, the interaction of the system administrator and the attacker in organizing the protection of information resources. The tasks are solved for various conditions – the game matrix contains cost estimates of resources and the matrix reflects the probability of threat realization. Pure and mixed strategies are defined for various initial conditions, which allows to exclude from the consideration strategies that are not included in the solution. A synergistic approach to the use of game-theoretic modeling was formed taking into account the behavior of agents of security systems, based on an analysis of the diversity and characteristics of game-theoretic models, their inherent limitations and scope

Due to the widespread use of sensors and sensor networks in the tasks of territory coverage, the relevant criteria are maximizing coverage and minimizing energy consumption. At the same time, the compliance of the network with these criteria is an urgent problem in the modern technological world. A modification of the method for constructing energy-efficient sensor networks is proposed by introducing an additional criterion for minimizing the number of sensors and limiting the number of sensors used, which allows reducing the energy consumption of sensor networks by 19 %. In the resulting optimization problem, the optimality criteria are the functions of minimizing the area of uncovered territory, the value of energy consumption, and the number of sensors. The optimum solution is formed by pairs of values of the coverage radius and the level of intersection of the coverage areas, which provide maximum coverage while minimizing energy consumption and the number of sensors used. To solve the problem, the parameter convolution method and the genetic algorithm were used. In the case of dynamic sensors, the problem is to find such a trajectory of the sensor that provides the maximum flyby of the territory with a minimum length. A grid algorithm is proposed to find the necessary trajectory. The presented algorithm consists in dividing the territory into nodes and estimating the value of the covered territory by the sensor in this node. After the formation of estimates, the search for a Hamiltonian path was used. The case of a multiply connected territory with the possibility of turning it into a simply connected one is considered. A scheme for finding the parameters of energy-efficient coverage of the territory using static and dynamic sensors is proposed.

The results of modeling and analysis of scenarios of the behavior of interacting agents in conditions of cyber conflict are presented. General approaches to the development of a scenario of the behavior of antagonistic agents are presented. The definition of the scenario is given and the factors determining the scenario of behavior are highlighted. The given scenarios are determined by such factors as the ratio of the capabilities of the attacking and the defending sides, the presence or absence of information exchange between security agents, and the time of switching to a new attack vector. The value of the time of switching to a new attack vector is found, at which the interaction is more stable. This indicates that the reaction of the defense side should not be purely reactive, and the “wait and see” strategy is not always the best. Modeling and analysis of the results were carried out in the conditions of information exchange between agents of the protection system and in the absence of such an exchange. The advantages and disadvantages of this behavior are noted. It is shown that when changing the time of switching to a new attack vector, not only the financial indicators of the activity of the participants in cyber conflict change, but also the nature of the interaction. The value of the time of switching to a new attack vector was found, in which the interaction is more stable, which suggests that the reaction of the defense side should not be purely reactive, and the “wait and see” strategy is not always the best. It is shown how the proposed approach can be used to justify the choice of a strategy for agent behavior in security systems, as well as for economic assessments of countermeasures and their deterrent effect on attackers. The proposed scenarios can be considered as a useful tool for assessing investments in the security of the business process circuit by decision makers

The results of the development of the model of the antagonistic agents behavior in a cyber conflict are presented. It is shown that the resulting model can be used to analyze investment processes in security systems, taking into account the assumption that investment processes are significantly influenced by the behavior of parties involved in a cyber conflict. General approaches to model development are presented. First of all, the system of concepts, assumptions and limitations is formed, within the framework of which a mathematical model of behavior must be developed. Taking this into account, the mathematical model of the conflicting agents behavior, presented in the form of algebraic and differential equations, is developed. The developed model presents both the technical characteristics of the security system and the psychological characteristics of the participants in the cyber conflict, which affect the financial characteristics of the investment processes in cybersecurity systems. A distinctive feature of the proposed model is the simultaneous consideration of the behavior of the parties to a cyber conflict not as independent parties, but as agents mutually interacting with each other. The model also makes it possible to simulate the destabilizing effect of the confrontation environment disturbances on the behavior of the conflicting parties, changing the degree of vulnerability of the cybersecurity system along various attack vectors and the level of their success. Using the developed model, simulation modeling of the interacting agents behavior in a cyber conflict is performed. The simulation results showed that even the simplest behavior strategies of the attacking side (“the weakest link”) and the defense side (“wait and see”) make it possible to ensure information security of the business process loop. The developed model of interaction between the attacker and the defender can be considered as a tool for modeling the processes of the conflicting parties behavior when implementing various investment scenarios. The simulation results enable decision-makers to receive support regarding the direction of investment in the security of the business process loop.

The development of computing tools and technologies of corporate networks has expanded the range of educational and information services in corporate research and education networks (CRES). CRES belong to critical cybernetic information systems (CCIS) built on the basis of open network models. In the early 80s of the 20th century, this approach did not consider the need to build a security system, which does not allow it to provide the required level of protection against modern hybrid threats. The transition to autonomy in decision-making, education and university management all over the world places requirements to ensuring the required quality of service (QoS) of CRES clients. CRES users include university administration, faculty, students and support personnel of educational services in higher education institutions. One of the main criteria for QoS is information security. However, there is no general approach to building integrated information security in CRES, which would provide the required level of security. The methodology is based on the concept of synthesizing a synergistic model of threats to CCIS, improved models of CRES infrastructure, an intruder, assessing the current state of information security (IS) and improved method of investment in the CRES IS. It is shown that the basis of the synergistic model is a three-level model of strategic security management, which provides a synergistic effect in the context of simultaneous threats to information security, cybersecurity and security of information. In contrast to the known, such an approach provides for the determination of qualitatively new and previously unknown emergent properties of the information security system, taking into account the means used to create it. The application of the methodology in practice through the development and implementation of new solutions to provide security services allows for the required level of information security in CRES. The proposed information security service mechanisms are built on hybrid cryptosystems based on crypto-code structures with flawed codes.

The basic concepts that form the basis of integrated modeling of the behavior of antagonistic agents in cybersecurity systems are identified. It is shown that the emphasis is largely on modeling the behavior of one of the cyber conflict parties only. In the case when the interaction of all parties to the conflict is considered, the approaches used are focused on solving particular problems, or they model a simplified situation. A methodology for modeling the interaction of antagonistic agents in cybersecurity systems, focused on the use of a multi-model complex with elements of cognitive modeling, is proposed. For this objective, the main components of cyber conflict are highlighted, the models of which must be developed. Modeling the interaction of antagonistic agents is proposed to be implemented as a simulation of situations. The concept of a situation is formulated and its components are presented. In the proposed methodology, traditional methods and modeling tools are not opposed, but are considered together, thus forming a unified methodological basis for modeling the antagonistic agents’ behavior. In the proposed multi-model complexes, the individual elements and functions of the entities under study are described using various classes of models at a certain level of detail. Coordinated use of various models allows improving the quality of modeling by compensating for the shortcomings of some models by the advantages of others, in particular, reflecting the dynamics of interaction in system-dynamic and agent-based models, which is difficult in classical models of game theory. Multi-model complexes allow stating the concept of «virtual modeling». This concept allows simulation using models of various classes. The choice of a class of models should correspond to the goals and objectives of modeling, the nature and structure of the source data. As a result of research, a methodology is proposed for modeling the interaction of antagonistic agents in cybersecurity systems using methods based on the proposed models of the reflective behavior of antagonistic agents under modern hybrid threats conditions

The development of the modern world community is closely related to advances in computing resources and cyberspace. The formation and expansion of the range of services is based on the achievements of mankind in the field of high technologies. However, the rapid growth of computing resources, the emergence of a full-scale quantum computer tightens the requirements for security systems not only for information and communication systems, but also for cyber-physical systems and technologies. The methodological foundations of building security systems for critical infrastructure facilities based on modeling the processes of behavior of antagonistic agents in security systems are discussed in the first chapter. The concept of information security in social networks, based on mathematical models of data protection, taking into account the influence of specific parameters of the social network, the effects on the network are proposed in second chapter. The nonlinear relationships of the parameters of the defense system, attacks, social networks, as well as the influence of individual characteristics of users and the nature of the relationships between them, takes into account. In the third section, practical aspects of the methodology for constructing post-quantum algorithms for asymmetric McEliece and Niederreiter cryptosystems on algebraic codes (elliptic and modified elliptic codes), their mathematical models and practical algorithms are considered. Hybrid crypto-code constructions of McEliece and Niederreiter on defective codes are proposed. They can significantly reduce the energy costs for implementation, while ensuring the required level of cryptographic strength of the system as a whole. The concept of security of corporate information and educational systems based on the construction of an adaptive information security system is proposed.