Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks
This paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the conside...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2023-09-01
|
| Series: | Mathematics |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2227-7390/11/18/3939 |
| _version_ | 1827725389996228608 |
|---|---|
| author | Grigorii Asyaev Alexander Sokolov Alexey Ruchay |
| author_facet | Grigorii Asyaev Alexander Sokolov Alexey Ruchay |
| author_sort | Grigorii Asyaev |
| collection | DOAJ |
| description | This paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the considered algorithms are revealed, and their applicability to the processing of the information security events of the UNSW-NB 15 dataset is analyzed. The dataset used contains raw network packets collected using the IXIA PerfectStorm software in the CyberRange laboratory of the Australian Cyber Security Centre (Canberra) in order to create a hybrid of the simulation of the real actions and the synthetic behavior of the network traffic generated during attacks. The possibility of applying four semantic proximity algorithms to partition process the data into clusters based on attack type in a distribution control system (DCS) is analyzed. The percentage of homogeneous records belonging to a particular type of attack is used as the metric that determines the optimal method of cluster partitioning. This metric was chosen under the assumption that cyberattacks located “closer” to each other in the multidimensional space have similar defense strategies. A hypothesis is formulated about the possibility of transferring knowledge about attacks from the vector feature space into a semantic form using semantic proximity methods. The percentage of homogeneous entries was maximal when the cosine proximity measure was used, which confirmed the hypothesis about the possibility of applying the corresponding algorithm in the recommender system. |
| first_indexed | 2024-03-10T22:29:40Z |
| format | Article |
| id | doaj.art-194531f545f449f1b8d0cae246bbb201 |
| institution | Directory Open Access Journal |
| issn | 2227-7390 |
| language | English |
| last_indexed | 2024-03-10T22:29:40Z |
| publishDate | 2023-09-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Mathematics |
| spelling | doaj.art-194531f545f449f1b8d0cae246bbb2012023-11-19T11:49:41ZengMDPI AGMathematics2227-73902023-09-011118393910.3390/math11183939Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against CyberattacksGrigorii Asyaev0Alexander Sokolov1Alexey Ruchay2Department of Information Security, South Ural State University, Chelyabinsk 454080, RussiaDepartment of Information Security, South Ural State University, Chelyabinsk 454080, RussiaDepartment of Information Security, South Ural State University, Chelyabinsk 454080, RussiaThis paper considers the main approaches to building algorithms for the decision support systems of information protection strategies against cyberattacks in the networks of automated process control systems (the so-called recommender systems). The advantages and disadvantages of each of the considered algorithms are revealed, and their applicability to the processing of the information security events of the UNSW-NB 15 dataset is analyzed. The dataset used contains raw network packets collected using the IXIA PerfectStorm software in the CyberRange laboratory of the Australian Cyber Security Centre (Canberra) in order to create a hybrid of the simulation of the real actions and the synthetic behavior of the network traffic generated during attacks. The possibility of applying four semantic proximity algorithms to partition process the data into clusters based on attack type in a distribution control system (DCS) is analyzed. The percentage of homogeneous records belonging to a particular type of attack is used as the metric that determines the optimal method of cluster partitioning. This metric was chosen under the assumption that cyberattacks located “closer” to each other in the multidimensional space have similar defense strategies. A hypothesis is formulated about the possibility of transferring knowledge about attacks from the vector feature space into a semantic form using semantic proximity methods. The percentage of homogeneous entries was maximal when the cosine proximity measure was used, which confirmed the hypothesis about the possibility of applying the corresponding algorithm in the recommender system.https://www.mdpi.com/2227-7390/11/18/3939attack vectorcyberattackdecision support systemautomated process control systempredictive information protectioncollaborative filtering |
| spellingShingle | Grigorii Asyaev Alexander Sokolov Alexey Ruchay Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks Mathematics attack vector cyberattack decision support system automated process control system predictive information protection collaborative filtering |
| title | Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks |
| title_full | Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks |
| title_fullStr | Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks |
| title_full_unstemmed | Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks |
| title_short | Intelligent Algorithms for Event Processing and Decision Making on Information Protection Strategies against Cyberattacks |
| title_sort | intelligent algorithms for event processing and decision making on information protection strategies against cyberattacks |
| topic | attack vector cyberattack decision support system automated process control system predictive information protection collaborative filtering |
| url | https://www.mdpi.com/2227-7390/11/18/3939 |
| work_keys_str_mv | AT grigoriiasyaev intelligentalgorithmsforeventprocessinganddecisionmakingoninformationprotectionstrategiesagainstcyberattacks AT alexandersokolov intelligentalgorithmsforeventprocessinganddecisionmakingoninformationprotectionstrategiesagainstcyberattacks AT alexeyruchay intelligentalgorithmsforeventprocessinganddecisionmakingoninformationprotectionstrategiesagainstcyberattacks |