
Content of 4th issue of magazine «Voprosy kiberbezopasnosti» at 2020:
Title | Pages |
Kalashnikov, A. O. MANAGEMENT OF INFORMATION RISKS FOR COMPLEX SYSTEM USING THE “COGNITIVE GAME” MECHANISM / A. O. Kalashnikov, E. V. Anikina // Cybersecurity issues. – 2020. – № 4(38). – С. 2-10. – DOI: 10.21681/2311-3456-2020-04-2-10.
AbstractPurpose of the article: development of mechanisms for solving problems of information risk management of complex systems in conditions of uncertainty and mutual influence of system elements on each other.Research method: game-theoretic mathematical modeling of risk management processes in complex systems based on arbitration schemes and multistep games on cognitive maps.The result: a general model of a complex system (for example, a heterogeneous computer network) is considered, within which the risk manager (risk-manager) carries out effective risk management by distributing the resource at his disposal among its elements (nodes of a computer network). To assess the state of the system elements, functions of local risk are proposed that satisfy certain specified requirements, and to assess the state of the system as a whole, an integral risk function is proposed.It is shown that in the case of independence (absence of mutual influence on each other) of the system elements to find an effective resource allocation, a game-theoretic approach can be used based on an arbitration scheme based on the principles of stimulation and non-suppression (MS-solution).For the case when changes in the level of risk for one element of the system can have a significant impact on the levels of risks of other elements, it is proposed to use game-theoretic models based on the MS-solution and a multistep “cognitive game”. Keywords: local risk, integral risk, risk manager, game-theoretic models, arbitration scheme, maximally stimulating decision, cognitive map, multistep cognitive game. References1. Kalashnikov A.O. Modeli i metodi organizacionnogo upravleniya informacionnimi riskami korporacii / A.O. Kalashnikov – M.: Egves, 2011, p. 312- ISBN 978-5-91450-078-5. 2. Kalashnikov A.O. Organizacionnie mehanizmi upravleniya informacionnimi riskami korporacii // A.O. Kalashnikov – М.: PMSOFT, 2008. p.175 – ISBN 978-5-9900281-9-7. 3. Ehrgott Matthias Multicriteria Optimization // Matthias Ehrgott. – Springer Berlin Heidelberg, 2010. P. 382. 4. Kozlov A.D., Noga N.L. Riski informacionnoi bezopasnosti korporativnih informacionnih system pri ispolzovanii oblachnih tehnologii / A.D. Kozlov, N.L. Noga // Upravlenie riskom. 2019. № 3. pp. 31-46. 5. Upravlenie informacionnimi riskami s ispolzovaniem arbitrajnih shem / A.O. Kalashnikov // Sistemi upravleniya i informacionnie tehnologii. 2004. № 4 (16). pp. 57-61. 6. Petrenko S.A. Upravlenie informacionnimi riskami. Ekonomicheski opravdannaya bezopasnost / S.A. Petrenko, S.V. Simonov – М.: Kompaniya AiTi; DMK Press, 2004. 384 p. – ISBN 5-98453-001-5 (AiTi) – ISBN 5-94074-246-7 (DMK Press). 7. Astahov A.M. Iskusstvo upravleniya informacionnimi riskami / A.M. Astahov – М.: DMK Press, 2010. 312 p. – ISBN 978-5-94074-574-7. 8. Damodaran Asvat Strategicheskiy risk-manadjement: principi i metodiki: Per.s angl. / А. Damodaran – М.: ООО «I.D. Viliams», 2017. 496 p. – ISBN 978-5-8459-1453-8 (rus.). 9. Barabanov A.V. Sem bezopasnih informacionih tehnologii. Pod red. A.S. Markova / A.V. Barabanov, A.V. Dorofeev, A.S. Markov, V.L. Cirlov – М.: DMK Press, 2017. 224 p. – ISBN 978-5-97060-494-6. 10. Novikov D.A. Teoriya upravleniya organizacionnimi sistemami. 3-е izd. / D.A. Novikov. – М.: Izdatelstvo fiziko-matematicheskoi literaturi, 2012. 604 p. 11. Upravlenie informacionnimi riskami organizacionnih system: obshaya postanovka zadachi / А.О. Kalashikov // Informaciya i bezopasnost. – 2016. Tom 19. № 1(4). pp. 36-45. 12. Upravlenie informacionnimi riskami organizacionnih system: mehanizmi kompleksnogo ocenivaniya / А.О. Kalashikov // Informaciya i bezopasnost. 2016. Tom 19. № 3(4). pp. 315-322. 13. Model upravleniya informacionnoi bezopasnostiyu kriticheskoi informacionnoi infrstructuri na osnove viyavleniya anomalnih sostoyanii (Chast 1) / А.О. Kalasnikov, E.V. Anikina // Informaciya I bezopasnost. 2018. Tom 21. № 2(4). pp. 145-154. 14. Model upravleniya informacionnoi bezopasnostiyu kriticheskoi informacionnoi infrstructuri na osnove viyavleniya anomalnih sostoyanii (Chast 2) / А.О. Kalashnikov, E.V. Anikina // Informaciya I bezopasnost. 2018. Tom 21. № 2(4). pp. 155-164. 15. Roberts F.S. Discretnie matematicheskie modeli s prilojeniyami k socialnim, biologicheskim i ekologicheskim zadacham. / F.S. Roberts. – М.: Nauka, 1986. 496 p. 16. «Kognitivnie igri»: lineinaya impulsnaya model/ D.A. Novikov // Problemi upravleniya. 2008. № 3. p. 14-22. 17. Cognitive Maps in Rats and Men / E. Tolman // Psychological Review. – 1948. № 55, pp.189-208. 18. Sistematizaciya kognitivnih kart i metodov ih analiza / А.А. Kulinich // Tr. VII-i mejdunar. konf. «Kognitivnii analiz i upravlenie razvitiem situacii ». – М.: IPU RAN, 2007. pp. 50-56. 19. Structurno-celevoi analiz razvitiya socialno-ekonomicheskih situacii / V.I. Maksimov // Problemi upravleniya. 2005. № 3. pp. 30-38. 20. Kognitivnii podhod v upravlenii / Z.K. Avdeeva, S.V. Kovriga, D.I. Makarenko, V.I. Maksimov // Problemi upravleniya. 2007. № 3. pp. 2-8. |
2-10 |
Gaifulina, D. A. APPLICATION OF DEEP LEARNING METHODS IN CYBERSECURITY TASKS. PART 2 / D. A. Gaifulina, I. V. Kotenko // Cybersecurity issues. – 2020. – № 4(38). – С. 11-21. – DOI: 10.21681/2311-3456-2020-4-11-21.
AbstractThe purpose of the article: comparative analysis of methods for solving various cybersecurity problems based on the use of deep learning algorithms.Research method: Systematic analysis of modern methods of deep learning in various cybersecurity applications, including intrusion and malware detection, network traffic analysis, and some other tasks. The result obtained: classification scheme of the considered approaches to deep learning in cybersecurity, and their comparative characteristics by the used models, characteristics, and data sets. The analysis showed that many deeper architectures with a large number of neurons on each layer show better results. Recommendations are given for using deep learning methods in cybersecurity applications.The main contribution of the authors to the research of deep learning methods for cybersecurity tasks is the classification of the subject area; conducting a general and comparative analysis of existing approaches that reflect the current state of scientific research. Keywords: data science, machine learning, deep neural networks, intrusion detection, malware detection. References1. Gaifulina D., Kotenko I., Application of deep learning methods in cybersecurity tasks. Part 1 // Voprosy kiberbezopasnosti, No.3, 2020. P. 76-86. 2. Gharib M., Mohammadi B., Dastgerdi S.H., Sabokrou M. AutoIDS: Auto-encoder Based Method for Intrusion Detection System // arXiv preprint arXiv:1911.03306. 2019. P. 1-9. 3. Tavallaee M., Bagheri E., Lu W., Ghorbani A.A. A detailed analysis of the KDD CUP 99 data set // Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), Ottawa, ON, Canada, 8–10 July 2009. P. 1-6. 4. Mohamed S., Ejbali R., Zaied M. Denoising Autoencoder with Dropout based Network Anomaly Detection // The Fourteenth International Conference on Software Engineering Advances (ICSEA), 2019. P. 98-104. 5. Ieracitano C., Adeel A., Morabito F.C., Hussain A.A Novel Statistical Analysis and Autoencoder Driven Intelligent Intrusion Detection Approach // Neurocomputing. 2019. P. 1-12. 6. Yang Y., Zheng K., Wu C., Yang Y. Improving the Classification Effectiveness of Intrusion Detection by Using Improved Conditional Variational AutoEncoder and Deep Neural Network // Sensors. 2019. Vol. 19. No. 11. P. 2528. 7. Farahnakian F., Heikkonen J. A deep auto-encoder based approach for intrusion detection system // 20th International Conference on Advanced Communication Technology (ICACT). IEEE, 2018. P. 178-183. 8. Mayuranathan M., Murugan M., Dhanakoti V. Best features based intrusion detection system by RBM model for detecting DDoS in cloud environment // Journal of Ambient Intelligence and Humanized Computing. 2019. P. 1-11. 9. Geem Z.W., Kim J.H., Loganathan G.V. A new heuristic optimization algorithm: harmony search // Simulation. 2001. Vol. 76. No. 2. P. 60-68. 10. KDD Cup 1999 Data. Available at: http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html (accessed April 29, 2020). 11. Nguyen K.K., Hoang D.T., Niyato D., Wang P., Nguyen D., Dutkiewicz E. Cyberattack Detection in Mobile Cloud Computing: A Deep Learning Approach // 2018 IEEE Wireless Communications and Networking Conference (WCNC). IEEE, 2018. P. 1-6. 12. Yin C., Zhu Y., Fei J., He X. A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks // IEEE Access, 2017. Vol. 5. P. 21954-21961. 13. Zhu M., Ye K., Wang Y., Xu C.Z. A Deep Learning Approach for Network Anomaly Detection Based on AMF-LSTM // IFIP International Conference on Network and Parallel Computing Springer, Cham, 2018. P. 137-141. 14. Manavi M., Zhang Y. A New Intrusion Detection System Based on Gated Recurrent Unit (GRU) and Genetic Algorithm // International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, Springer, Cham, 2019. P. 368-383. 15. Qin Y., Wei J., Yang W. Deep Learning Based Anomaly Detection Scheme in Software-Defined Networking // 20th Asia-Pacific Network Operations and Management Symposium (APNOMS), IEEE, 2019. P. 1-4. 16. Yin C., Zhu Y., Liu S., Fei J., Zhang H. An Enhancing Framework for Botnet Detection Using Generative Adversarial Networks // 2018 International Conference on Artificial Intelligence and Big Data (ICAIBD). IEEE, 2018. P. 228-234. 17. Chen H., Jiang L. GAN-based method for cyber-intrusion detection // arXiv preprint arXiv:1904.02426, 2019. P. 1-6.18. De Paola A., Favaloro S., Gaglio S., Re G.L., Morana M. Malware Detection through Low-level Features and Stacked Denoising Autoencoders // 2nd Italian Conference on Cyber Security (ITASEC), 2018. P. 1-10. 19. Ye Y., Chen L., Hou S., Hardy W., Li X. DeepAM: A Heterogeneous Deep Learning Framework for Intelligent Malware Detection // Knowledge and Information Systems, 2018. Vol. 54. No. 2. P. 265-285. 20. Comodo Anti-Malware Database. Available at: https://www.comodo.com/home/internet-security/updates/vdp/database.php (accessed April 29, 2020). 21. Naway A., Li Y. Android Malware Detection Using Autoencoder // arXiv preprint arXiv:1901.07315. 2019. P. 1-9. 22. Xiao X., Zhang S., Mercaldo F., Hu G., Sangaiah A.K. Android Malware Detection Based on System Call Sequences and LSTM // Multimedia Tools and Applications. 2019. Vol. 78. No. 4. P. 3979-3999. 23. Arp D., Spreitzenbarth M., Hubner M., Gascon H., Rieck K., Siemens, C.E.R.T. DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket // Network and Distributed System Security (NDSS), 2014. Vol. 14. P. 23-26. 24. Rhode M., Burnap P., Jones K. Early-stage Malware Prediction Using Recurrent Neural Networks // Computers & security. 2018. Vol. 77. P. 578-594. 25. Darabian H., Homayounoot S., Dehghantanha A., Hashemi S., Karimipour H., Parizi R. M., Choo K.K.R. Detecting Cryptomining Malware: a Deep Learning Approach for Static and Dynamic Analysis // Journal of Grid Computing. 2020. P. 1-11. 26. Karbab E.B., Debbabi M., Derhab A., Mouheb D. MalDozer: Automatic Framework for Android Malware Detection Using Deep Learning // Digital Investigation. 2018. Vol. 24. P. S48-S59. 27. Zhou Y., Jiang X. Dissecting Android Malware: Characterization and Evolution // 2012 IEEE Symposium on Security and Privacy. IEEE, 2012. P. 95-109. 28. Karbab E.B., Debbabi M., Derhab A., Mouheb D. Android malware detection using deep learning on API method sequences //arXiv preprint arXiv:1712.08996. 2017. P. 1-17. 29. Mishra P., Khurana K., Gupt S., Sharma M.K. VMAnalyzer: Malware Semantic Analysis using Integrated CNN and Bi-Directional LSTM for Detecting VM-level Attacks in Cloud // Twelfth International Conference on Contemporary Computing (IC3). IEEE, 2019. P. 1-6. 30. UNM Dataset, 1998. Available at: https://www.cs.unm.edu/~immsec/systemcalls.htm (accessed April 25, 2020). 31. Jan S., Ali T., Alzahrani A., Musa S. Deep Convolutional Generative Adversarial Networks for Intent-based Dynamic Behavior Capture // International Journal of Engineering & Technology, 2018. Vol. 7. No. 4.29. P. 101-103. 32. Amin M., Shah B., Sharif A., Ali T., Kim K.L., Anwar S.. Android Malware Detection through Generative Adversarial Networks // Transactions on Emerging Telecommunications Technologies. 2019. P. e3675. 33. Shibahara T., Yagi T., Akiyama M., Chiba D., Hato K. Efficient Dynamic Malware Analysis for Collecting HTTP Requests using Deep Learning // IEICE Transactions on Information and Systems, 2019. Vol. 102. No. 4. P. 725-736. 34. VirusTotal. Available at: https://virustotal.com (accessed April 29, 2020). 35. Wang P., Ye F., Chen X., Qian Y. DataNet: Deep Learning Based Encrypted Network Traffic Classification in SDN Home Gateway // IEEE Access, 2018. Vol. 6. P. 55380-55391. 36. ISCX VPN-non-VPN dataset. Available at: https://www.unb.ca/cic/datasets/ids.html (accessed April 29, 2020). 37. Lotfollahi M., Siavoshani M.J., Zade R.S.H., Saberian M. Deep Packet: A Novel Approach for Encrypted Traffic Classification Using Deep Learning // Soft Computing. 2020. Vol. 24. No. 3. P. 1999-2012. 38. Smit D., Millar K., Page C., Cheng A., Chew H.G., Lim C.C. Looking deeper: Using deep learning to identify Internet communications traffic // Australasian Conference of Undergraduate Research (ACUR), Adelaide, 2017. P. 124-144. 39. UNSW-NB15 Dataset. Available at: https://www.unsw.adfa.edu.au/unsw-canberra-cyber/cybersecurity/ADFA-NB15-Datasets/ (accessed April 29, 2020). 40. Tuor A., Kaplan S., Hutchinson B., Nichols N., Robinson S. Deep learning for unsupervised insider threat detection in structured cybersecurity data streams // Workshops at the Thirty-First AAAI Conference on Artificial Intelligence, 2017. P. 224-231. 41. Insider Threat Test Dataset. Available at: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=508099 (accessed April 29, 2020). 42. Meng F., Lou F., Fu Y., Tian Z. Deep Learning Based Attribute Classification Insider Threat Detection for Data Security // 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC). IEEE, 2018. P. 576-581. 43. Li Y., Nie X., Huang R. Web spam classification method based on deep belief networks // Expert Systems with Applications. 2018. Vol. 96. P. 261-270 44. WEBSPAM-UK2007 (current dataset). Available at: https://chato.cl/webspam/datasets/uk2007/ (accessed April 29, 2020). 45. Jain G., Sharma M., Agarwal B. Optimizing semantic LSTM for spam detection // International Journal of Information Technology. 2019. Vol. 11. No. 2. P. 239-250. 46. Saxe J., Berlin K. eXpose: A Character-Level Convolutional Neural Network with Embeddings for Detecting Malicious URLs, File Paths and Registry Keys // arXiv preprint arXiv:1702.08568. 2017. P. 1-18. 47. Tian Z., Luo C., Qiu J., Du X., Guizani M. A Distributed Deep Learning System for Web Attack Detection on Edge Devices // IEEE Transactions on Industrial Informatics, 2019. P. 1-8. 48. CSIC 2010 HTTP Dataset in CSV Format Available at: https://petescully.co.uk/research/csic-2010-http-dataset-in-csv-format-for-wekaanalysis/ (accessed April 29, 2020). 49. Fwaf-Machine-Learning-driven-Web-Application-Firewall Available at: https://github.com/faizann24/ Fwaf-Machine-Learning-drivenWeb-Application-Firewall (accessed April 29, 2020). |
11-21 |
Vasilyev, V. I. AUTOMATION OF SOFTWARE VULNERABILITIES ANALYSIS ON THE BASIS OF TEXT MINING TECHNOLOGY / V. I. Vasilyev, A. M. Vulfin, N. V. Kuchkarova // Cybersecurity issues. – 2020. – № 4(38). – С. 22-31. – DOI: 10.21681/2311-3456-2020-04-22-31.
AbstractPurpose: the development of automated system of software vulnerabilities analysis for information-control systems on the basis of intelligent analysis of texts written on the natural language (Text Mining). Methods: the idea of the used investigation method is based on matching the set of extracted software vulnerabilities and relevant information security threats by means of evaluating the semantic similarity metrics of their textual description with use of Text Mining methods. Practical relevance: the architecture of the automated system of software vulnerabilities analysis is developed, the application of which allows us to evaluate the level of vulnerabilities criticality and match it with the most suitable by discretion (i.e. semantically similar) threats from the Bank of information security threats of FSTEC Russia while ensuring vulnerabilities and threats. The main software modules of the system have been developed. Computational experiments were carried out to assess the effectiveness of its application. The results of comparative analysis show that application of the given system allows us to increase the credibility of evaluating the criticality degree of vulnerabilities, considerably decreasing the time for a search and matching vulnerabilities and threats. Keywords: information security threats, intelligent filtering, vector word representation, lemmatization, semantic proximity. References1. Smyth V. Vulnerability Intelligence // ITNOW, Dec. 2016. P.26-27. 2. Fedorchenko A.V., CHechulin A.A., Kotenko I.V. Issledovanie otkrytyh baz uyazvimostej i ocenka vozmozhnostej ih primeneniya v sistemah analiza zashchishchennosti komp’yuternyh setej // Informacionno-upravlyayushchie sistemyyu. 2014. №5. S.72-79. 3. Tao Wen, Yuquing Zhang, Gang Yang. A Novel Automatic Severity Vulnerability Assessment Framework // Journal of Communications, Vol. 10. №5. May 2015. pp. 320-329. 4. Detection and Remediation Method for Softwere Security / Jessoo Jurn, Taeeun Kim, Hwankuk Kim, An Automated Vulnerability // Sustainability, May 2018. №10. 1657; doi: 10?3390/ su10051652012. 5. Spanos G., Angeis L., Toloudis D. Assessment of Vulnerability Severity using Text Mining // Proceedings of the 21st Pan-Hellenic Conference, Sept.2017, Larissa, Greece. pp. 1-6. 6. Learning to Predict Severity of Software Vulnerability Description / Han Z., Li X., Xing Z., Liu H., Feng Z. // Proceedings of the 2017 International Conference on Software Maintenance and Evolution (ICSME), Shanghai, China, Nov. 2017. pp. 125-136. 7. Lee Y., Shin S. Toward Semantic Assessment of Vulnerability Severity: A Text Mining Approach // Proceedings of ACM CIKM Workshop (EYRE' 18), 2018. [Электронный ресурс]. URL: https://www.CEUR-WS.org/Vol1-2482/papers.pdf (дата обращения 01.08.2020). 8. O probleme vyyavleniya ekstremistskoj napravlennosti v tekstah// Vestnik Novosibirskogo gosudarstvennogo universiteta / Anan’eva M.I., Kobozeva M.V., Solov’ev F.N., Polyakov I.V., CHepovskij A.M.// Seriya: Informacionnye tekhnologii. 2016.T.14.S.5-13. 9. Sravnitel’nyj analiz special’nyh korusov tekstov dlya zadach bezopasnosti / Lavrent’ev A.M., Ryabova D.M., Tihomirova E.A., Fokina A.I., CHepovskij A.M., SHerstinova T.YU. // Voprosy kiberbezopasnosti. 2020. №3(37). S.54-60. 10. Mittal S. et al. Cybertwitter: Using twitter to generate alerts for cybersecurity threats and vulnerabilities //2016 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), IEEE. 2016. pp. 860-867. 11. Benjamin V. et al. Exploring threats and vulnerabilities in hacker web: Forums, IRC and carding shops //2015 IEEE international conference on intelligence and security informatics (ISI). – IEEE. 2015. С. 85-90. 12. de Boer M. H. T. et al. Text Mining in Cybersecurity: Exploring Threats and Opportunities // Multimodal Technologies and Interaction. 2019. Т. 3. №. 3. pp. 62. 13. Nunes E. et al. Darknet and deepnet mining for proactive cybersecurity threat intelligence //2016 IEEE Conference on Intelligence and Security Informatics (ISI). IEEE. 2016. pp. 7-12. 14. Epishkina A., Zapechnikov S. A syllabus on data mining and machine learning with applications to cybersecurity //2016 Third International Conference on Digital Information Processing, Data Mining, and Wireless Communications (DIPDMWC). IEEE/ 2016. pp. 194-199. 15. Selifanov V.V., Yurakova Ya.V., Karmanov I.N. Metodika avtomatizirovannogo vy`yavleniya vzaimosvyazej uyazvimostej i ugroz bezopasnosti informacii v informacionny`x sistemax //Intere`kspo Geo-Sibir`, 2018. pp.271-276. 16. Primenenie metodov avtomatizacii pri opredelenii aktual’nyh ugroz bezopasnosti informacii v informacionnyh sistema s primeneniem banka dannyh ugroz FSTEK Rossii / Selifanov V. V., Zvyaginceva P.A., YUrakova YA.V., Slonkina I.S. //Interekspo Geo-Sibir’. 2017. T. 8. C.202-209. 17. Petrenko S. A., Petrenko A. S. Modelirovanie sistem obrabotki bol’shih dannyh kiberbezopasnosti //Informacionnye sistemy i tekhnologii v modelirovanii i upravlenii. 2016. S. 279-284 18. Mikolov T., Chen K., Corrado G. Dean J. Efficient Estimation of Word Representation in Vector Space // Proceedings of Workshop at ICLR, 2013. [Электронный ресурс]. URL: https://www.arXiv.1301.3781 (дата обращения 01.08.2020). 19. Bondarchuk D.V. Vektornaya model’ predstavleniya znanij na osnove semanticheskoj blizosti termov // Vestnik YUrGU.Seriya: Vychislitel’naya matematika i informatika, 2017. T.6. S.73-83. 20. Ali A., Alfaycz F., Alquhayz H. Semantic Similarity Measures Between Words: A Brief Survey // Sci.Int. (Lahore), №30 (6). 2018. pp. 907-914. 21. Gupta S., Gupta B. B. Detection, avoidance, and attack pattern mechanisms in modern web application vulnerabilities: present and future challenges //International Journal of Cloud Applications and Computing (IJCAC). 2017. Vol. 7. №. 3. pp. 1-43. |
22-31 |
Barabanov, A. AUTHENTICATION AND AUTHORIZATION IN MICROSERVICE-BASED SYSTEMS: SURVEY OF ARCHITECTURE PATTERNS / A. Barabanov, D. Makrushin // Cybersecurity issues. – 2020. – № 4(38). – С. 32-43. – DOI: 10.21681/2311-3456-2020-04-32-43.
AbstractObjective. Service-oriented architecture and its microservice-based approach increase an attack surface of applications. Exposed microservices become a pivot point for advanced persistent threats and completely change the threat landscape. Correctly implemented authentication and authorization architecture patterns are basis of any software maturity program. The aim of this study is to provide a helpful resource to application security architect and developers on existing architecture patterns to implement authentication and authorization in microservices-based systems.Method. In this paper, we conduct a systematic review of major electronic databases and libraries as well as security standards and presentations at the major security conferences.Results and practical relevance. In this work based on research papers and major security conferences presentations analysis, we identified industry best practices in authentication and authorization patterns and its applicability depending on environment characteristic. For each described patterns we reviewed its advantages and disadvantages that could be used as decision-making criteria for application security architects during architecture design phase. Keywords: microservice architectures, security, authentication, authorization, architecture patterns survey. References1. A. Boubendir, E. Bertin and N. Simoni, “A VNF-as-a-service design through micro-services disassembling the IMS,” 2017 20th Conference on Innovations in Clouds, Internet and Networks (ICIN), Paris, 2017, pp. 203-210. DOI: 10.1109/ICIN.2017.7899412 2. D. Lu, D. Huang, A. Walenstein and D. Medhi, “A Secure Microservice Framework for IoT,” 2017 IEEE Symposium on Service-Oriented System Engineering (SOSE), San Francisco, CA, 2017, pp. 9-18. DOI: 10.1109/SOSE.2017.27 3. Microservices Security in Action, Prabath Siriwardena and Nuwan Dias, 2020, Manning. 4. Li, Xing & Chen, Yan & Lin, Zhiqiang. (2019). Towards Automated Inter-Service Authorization for Microservice Applications. SIGCOMM Posters and Demos ‘19: Proceedings of the ACM SIGCOMM 2019 Conference Posters and Demos. 3-5. DOI:10.1145/3342280.3342288 5. Nehme, Antonio & Jesus, Vitor & Mahbub, Khaled & Abdallah, Ali. (2019). Fine-Grained Access Control for Microservices. DOI: 10.1007/978-3-030-18419-3_19 6. David Ferraiolo, Ramaswamy Chandramouli, Rick Kuhn, and Vincent Hu. 2016. Extensible Access Control Markup Language (XACML) and Next Generation Access Control (NGAC). In Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control (ABAC ’16). Association for Computing Machinery, New York, NY, USA, 13–24. DOI: 10.1145/2875491.2875496 7. D. Preuveneers and W. Joosen, «Towards Multi-party Policy-based Access Control in Federations of Cloud and Edge Microservices,» 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Stockholm, Sweden, 2019, pp. 29-38. DOI: 10.1109/EuroSPW.2019.00010 8. T. Yarygina and A. H. Bagge, «Overcoming Security Challenges in Microservice Architectures,» 2018 IEEE Symposium on ServiceOriented System Engineering (SOSE), Bamberg, 2018, pp. 11-20. 9. A. Bánáti, E. Kail, K. Karóczkai and M. Kozlovszky, “Authentication and authorization orchestrator for microservice-based software architectures,” 2018 41st International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, 2018, pp. 1180-1184. DOI: 10.23919/MIPRO.2018.8400214 10. Alexander Barabanov, Alexey Markov, Andrey Fadin, Valentin Tsirlov, and Igor Shakhalov. 2015. Synthesis of secure software development controls. In Proceedings of the 8th International Conference on Security of Information and Networks (SIN ’15). Association for Computing Machinery, New York, NY, USA, 93–97. DOI: 10.1145/2799979.2799998 11. M. Pahl and L. Donini, “Securing IoT microservices with certificates,” NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium, Taipei, 2018, pp. 1-5. DOI: 10.1109/NOMS.2018.8406189 12. Siriwardena P. (2020) Securing APIs with Transport Layer Security (TLS). In: Advanced API Security. Apress, Berkeley, CA. 13. Yung-Kao Hsu and S. P. Seymour, “An intranet security framework based on short-lived certificates”, in IEEE Internet Computing, vol. 2, no. 2, pp. 73-79, March-April 1998. DOI: 10.1109/4236.670687 14. A. Pereira-Vale, G. Márquez, H. Astudillo and E. B. Fernandez, “Security Mechanisms Used in Microservices-Based Systems: A Systematic Mapping,” 2019 XLV Latin American Computing Conference (CLEI), Panama, Panama, 2019, pp. 01-10. DOI: 10.1109/CLEI47609.2019.235060 15. Abdelhakim Hannousse, Salima Yahiouche. Securing Microservices and Microservice Architectures: A Systematic Mapping Study. URL: https://arxiv.org/abs/2003.07262 16. Dongjin Yu, Yike Jin, Yuqun Zhang, and Xi Zheng. A survey on security issues in services communication of microservices-enabled fog applications. Concurrency and Computation: Practice and Experience, 31(22):e4436, 2019. e4436 cpe.4436. 17. G. Fu, J. Sun and J. Zhao, “An optimized control access mechanism based on micro-service architecture,” 2018 2nd IEEE Conference on Energy Internet and Energy System Integration (EI2), Beijing, 2018, pp. 1-5. DOI: 10.1109/EI2.2018.8582628 18. Z. Triartono, R. M. Negara and Sussi, “Implementation of Role-Based Access Control on OAuth 2.0 as Authentication and Authorization System,” 2019 6th International Conference on Electrical Engineering, Computer Science and Informatics (EECSI), Bandung, Indonesia, 2019, pp. 259-263. DOI: 10.23919/EECSI48112.2019.8977061 19. B. Liu, Y. Yang and Z. Zhou, “Research on Hybrid Access Control Strategy for Smart Campus Platform,” 2018 IEEE 3rd Advanced Information Technology, Electronic and Automation Control Conference (IAEAC), Chongqing, 2018, pp. 342-346. DOI: 10.1109/IAEAC.2018.8577828 20. A. Barabanov, A. Markov and V. Tsirlov, “Procedure for substantiated development of measures to design secure software for automatedprocess control systems,” 2016 International Siberian Conference on Control and Communications (SIBCON), Moscow, 2016, pp. 1-4. DOI: 10.1109/SIBCON.2016.7491660 21. Gaifulina D.A., Kotenko I.V. Application of deep learning methods in cybersecurity tasks. Voprosy Kiberbezopasnosti. №3(37), 2020. p. 76-86. (in Russ.) DOI: 10.21681/2311-3456-2020-03-76-86 22. Sheluhin O.I., Ryabinin V.S., Farmakovskiy M.А., Anomaly detection in computer system by intellectictual analysis of system journals, Voprosy kiberbezopasnosti, №2(26), 2018. p 36-41. (in Russ.) DOI: 10.21681/2311-3456-2018-2-33-43 |
32-43 |
Vlasov, K. A. NEURAL CRYPTOGRAPHIC INFORMATION SECURITY SYSTEM OF RECURRENT CONVERGENT NEURAL NETWORKS / K. A. Vlasov // Cybersecurity issues. – 2020. – № 4(38). – С. 44-55. – DOI: 10.21681/2311-3456-2020-04-44-55.
AbstractThe purpose: to construct an algorithm for information transformation by recurrent convergent neural networks with a given set of local minima of the energy functional for its subsequent application in the field of information security.Method: system analysis of the existing neural network paradigms that can be used for classification of images. Neural cryptographic system synthesis is with analogy methods, recurrent convergent neural networks, noise-resistant encoding and block ciphers algorithms.The result: a promising neural cryptographic system is proposed that can be used to develop an algorithm for noise-resistant coding, symmetric or stream data encryption based on the generation of various variants of the distorted image representing the sequence of bits to mask the original message. An algorithm for block symmetric data encryption based on Hopfield-type neural networks has been created. Key information includes information on the selected (using radial basic functions) structural characteristics of the potential with a given set of energy minima, which determines the dynamics of the neural network as a potential dynamic system, whose attractors are symbols (several symbols) of the alphabet of the input text. The size of the key depends on the power of the alphabet of the original message and the form of representation of the energy functional. The presented neural cryptographic system can also be used in the authentication system. Keywords: neural cryptography, noise-resistant coding, symmetric encryption, a block cipher, authentication system, neural network with feedback, potential dynamical system, radial base function. References1. Yur’ev R.A. Obzor modelej nejrokriptografii // Vestnik nauchnyh konferencij, 2015, № 4-2 (4). S. 160-164. 2. Gridin V.N., Solodovnikov V.I. Postroenie algoritma simmetrichnogo shifrovaniya na osnove nejrosetevogo podhoda // Novye informacionnye tekhnologii v avtomatizirovannyh sistemah, 2015, №18. S. 98-107. 3. Bobrov R.B., Vershinin V.E. Kriptograficheskie metody zashchity dannyh s ispol’zovaniem iskusstvennyh nejronnyh setej // Elektronnyj zhurnal: nauka, tekhnika i obrazovanie, 2015, № 3. S. 9-14. 4. SHemyakina M.A. Sostoyanie, perspektivy i principy ispol’zovaniya nejrosetevyh tekhnologij v kriptografii // Forum molodyh uchenyh, 2018, № 12-4 (28). S. 721-728. 5. Mel’nikov V.A., SHniperov A.N. Podhody k primeneniyu iskusstvennyh nejronnyh sistem v kriptograficheskih zadachah // Aktual’nye problemy aviacii i kosmonavtiki, 2018, t. 2, № 4 (14). S. 232-234. 6. Pyatnickij I. A. Primenenie nejronnyh setej v shifrovanii // Bezopasnost’ informacionnogo prostranstva – 2017: XVI Vserossijskaya nauchno-prakticheskaya konferenciya studentov, aspirantov, molodyh uchenyh. Ekaterinburg, 12 dekabrya 2017 goda. – Ekaterinburg: Izd-vo Ural. un-ta, 2018. S. 44-46. 7. Protic Danijela D. Neural cryptography // VOJNOTEHNICKI GLASNIK, 2016, Vol. 64. № 2. P. 483-495. 8. P’yavchenko A.O., Lishchenko A.V. Nejronnye seti adaptivnogo rezonansa - kak sredstvo resheniya zadachi raspoznavaniya anomal’nyh obrazov // Alleya nauki, 2018, t. 4. № 11 (27). S. 91-100. 9. Baranov K.A., CHajchic N.N. Raspoznavanie obrazov i obrabotka dannyh s ispol’zovaniem nejronnyh setej // Aktual’nye napravleniya nauchnyh issledovanij XXI veka: teoriya i praktika, 2018, t. 6. № 6 (42). S. 37-38. 10. Babich N.A. Analiz effektivnosti primeneniya interferencionnoj nejronnoj seti dlya resheniya zadachi raspoznavaniya obrazov // Vestnik sovremennyh issledovanij, 2019, № 2.3 (29). S. 5-8. 11. Asyaev G.D., Nikol’skaya K.YU., Ali M.M. Primenenie nejronnoj seti dlya raspoznavaniya iskusstvenno sgenerirovannyh obrazov // Vestnik YUzhno-Ural’skogo gosudarstvennogo universiteta. Seriya: Komp’yuternye tekhnologii, upravlenie, radioelektronika. 2017. t. 17. № 3. S. 135-141. 12. Gridin V.N., Solodovnikov V.I., Evdokimov I.A. Nejrosetevoj algoritm simmetrichnogo shifrovaniya // Informacionnye tekhnologii, 2015, t. 21, № 4. S. 306-311. 13. .Solodovnikov V.I., Evdokimov I.A. Analiz kriptostojkosti nejrosetevogo algoritma simmetrichnogo shifrovaniya // Novye informacionnye tekhnologii v avtomatizirovannyh sistemah, 2016, № 19. S. 263-269. 14. Gridin V. N., Solodovnikov V. I. Issledovanie voprosov kriptostojkosti i metodov kriptoanaliza nejrosetevogo algoritma simmetrichnogo shifrovaniya // Izvestiya YUzhnogo federal’nogo universiteta. Tekhnicheskie nauki, 2016, №7 (180). S. 114-122. 15. Solodovnikov V.I. Uluchshenie kriptostojkosti nejrosetevogo algoritma simmetrichnogo shifrovaniya za schet ispol’zovaniya komitetov nejronnyh setej // Novye informacionnye tekhnologii v avtomatizirovannyh sistemah, 2017, №20. S.176-180. 16. Bajburin V.B., Rozov A.S., Horovodova N.YU. Kodirovanie informacii na osnove dinamicheskih sistem elektroniki // Informacionnaya bezopasnost’ regionov, 2015, № 3(20). S. 5-8. 17. Gajfulina D.A., Kotenko I.V. Primenenie metodov glubokogo obucheniya v zadachah kiberbezopasnosti. CHast’ 1 // ZHurnal «Voprosy kiberbezopasnosti», 2020, № 3 (37). – s. 76-86. 18. Dichenko S.A., Fin’ko O.A. Gibridnyj kripto-kodovyj metod kontrolya i vosstanovleniya celostnosti dannyh dlya zashchishchyonnyh informacionno-analiticheskih sistem // ZHurnal «Voprosy kiberbezopasnosti», 2019, № 6 (34). – s. 17-36. 19. Tarasov YA.V. Issledovanie primeneniya nejronnyh setej dlya obnaruzheniya nizkointensivnyh DDoS-atak prikladnogo urovnya // ZHurnal «Voprosy kiberbezopasnosti», 2017, № 5 (24). – s. 23-29. |
44-55 |
Krivonogov, A. A. METHODOLOGY FOR ANALYZING VULNERABILITIES AND DETERMINING THE SECURITY LEVEL OF A SMART CONTRACT WHEN PLACED IN DISTRIBUTED LEDGER SYSTEMS / A. A. Krivonogov, M. M. Repin, N. V. Fedorov // Cybersecurity issues. – 2020. – № 4(38). – С. 56-65. – DOI: 10.21681/2311-3456-2020-04-56-65.
AbstractEvery year, the technology of using smart contracts is attracting more and more attention from users due to the unique advantages that it possesses: automatic execution of transactions in a traceable and unchanging way without third party authorization. At the same time, a smart contract is one of the most vulnerable elements in distributed ledger systems, which can be susceptible to attack by intruders.The aim of the research is to develop a methodology that allows analyzing a smart contract for information security vulnerabilities and determining the security level of a smart contract before placing it in distributed ledger systems.Research methods: to achieve this goal, methods of static and dynamic analysis were studied, the most relevant information security vulnerabilities were identified, and parameters for calculating the criticality factor of vulnerability and the security level of a smart contract were determined.Result: a promising static-dynamic method for analyzing the vulnerabilities of a smart contract is proposed, which makes it possible to unambiguously determine the security level of a smart contract before its placement in the distributed ledger system. Its main parameters are set, and the reference security factors of a smart contract are determined. The complete algorithm of the static-dynamic method of analyzing a smart contract is described, and an example of a generated documentary security report based on the results of analyzing a smart contract is given. Keywords: static analysis, dynamic analysis, automated tools, information security, vulnerability criticality, testing, code audit. References1. Bishwas C Gupta. Analysis of Ethereum Smart Contracts – A Security Perspective / Department of Computer Science and Engineering. Indian Institute of Technology Kanpur, 2019, 70 p. 2. E. Marchenko and Y. Alexandrov. Smartcheck: Static analysis of ethereum smart contracts / 1st International Workshop on Emerging Trends in Software Engineering for Blockchain, ser. WETSEB ’18. ACM, 2018, pp. 9-16. 3. Repin M.M., Pshehotskaya E.A., Prostov I.A., Amfiteatrova S.S. Ispol’zovanie platformy na osnove raspredelennykh reestrov Ripple v bankovskikh platezhnykh sistemakh // Sistemnyy Administrator № 3 (196), 2019, pp. 86-89. 4. Atzei N., Bartoletti M., Cimoli T. A survey of attacks on Ethereum smart contracts / Principles of Security and Trust. – М.: Springer, Berlin, Heidelberg, 2017, pp. 164-186. 5. Alexander Frolov. Sozdanie smart-kontraktov Solidity dlya blokcheyna Ethereum. Prakticheskoe rukovodstvo / Alexander Frolov. – M.: Litres: Samizdat, 2019, 240 p. 6. Anton Vashkevich. Smart-kontrakty: chto, zachem i kak. – M.: Simploer, 2018, 98 p. 7. Fedorov N.V. Matematicheskoe i imitatsionnoe modelirovanie slozhnykh sistem. Uchebnoe posobie. – M.: MGIU, 2014, 252 p. 8. A. Mense and M. Flatscher. Security vulnerabilities in ethereum smart contracts. In Proceedings of the 20th International Conference on Information Integration and Web-based Applications & Services. ACM, 2018, pp. 375-380. 9. Petar Tsankov, Andrei Dan, Dana Drachsler-Cohen, Arthur Gervais, Florian Bünzli, and Martin Vechev. Securify: Practical Security Analysis of Smart Contracts. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. ACM, 2018, pp. 67-82. 10. Nikolic, Ivica & Kolluri, Aashish & Sergey, Ilya & Saxena, Prateek & Hobor, Aquinas. Finding The Greedy, Prodigal, and Suicidal Contracts at Scale. ACSAC, 2018, pp. 653-663. 11. G. Bigi, A. Bracciali, G. Meacci, and E. Tuosto. Validation of decentralised smart contracts through game theory and formal methods. In Programming Languages with Applications to Biology and Security. Springer, 2015, pp. 142-161. 12. Repin M.M., Pshehotskaya E.A. Obespechenie informatsionnoy bezopasnosti smart-kontraktov v sistemakh na osnove tekhnologii raspredelennykh reestrov // Sistemnyy Administrator № 5 (198), 2019, pp. 70-73. 13. B. Marino and A. Juels. Setting standards for altering and undoing smart contracts. In International Symposium on Rules and Rule Markup Languages for the Semantic Web. Springer, 2016, pp. 151-166. 14. Pitelinsky K.V., Alexandrova A.V. Struktura i printsip raboty smart-kontraktov // Sbornik nauchnykh statey po itogam raboty kruglogo stola s mezhdunarodnym uchastiem. 15-16 yanvarya 2020 g. Chast’ 2, 2020, pp. 101-103. 15. Ilya Grishchenko, Matteo Maffei, and Clara Schneidewind. A Semantic Framework for the Security Analysis of Ethereum Smart Contracts. In Principles of Security and Trust, Lujo Bauer and Ralf Küsters (Eds.). Springer International Publishing, Cham, 2018, pp. 243-269. |
56-65 |
Livshitz, I. I. ASSESSMENT OF THE IMPACT OF GENERAL DATA PROTECTION REGULATION ON ENTERPRISE SECURITY IN THE RUSSIAN FEDERATION / I. I. Livshitz // Cybersecurity issues. – 2020. – № 4(38). – С. 66-75. – DOI: 10.21681/2311-3456-2020-04-66-75.
AbstractThe purpose of the study is to analyze the existing requirements for personal data security and assess the impact of these requirements on the enterprises security in the Russian Federation.Research method: the problem of ensuring the security of personal data in accordance with the requirements of the Federal law of the Russian Federation FZ-152 and the international General Data Protection Regulation is investigated. The article analyzes the possible risks of interrupting the normal activities of enterprises in the Russian Federation due to violations of these requirements for personal data protection and the imposition of significant fines by international regulators. Numerical relationships are estimated between the amount of fines for violations of established requirements, including General Data Protection Regulation, and the cost of creating an effectiveness personal data protection system. Estimates of the permissible degree of influence of the General Data Protection Regulation requirements on the enterprises security in the Russian Federation are obtained.Research result: a study and comparison of possible penalties for violation of compliance with the requirements of the Federal law of the Russian Federation FZ-152 and the international General Data Protection Regulation was performed. Risk assessments of sanctions for violation of the established requirements for personal data protection were obtained. The analysis of the cost of preparing a personal data protection system for compliance with the requirements of the General Data Protection Regulation was performed. Based on the data obtained, examples of calculating the degree of maturity of the security system are presented - based on the ratio of the share of the budget allocated for security in relation to the cost of creating an effectiveness personal data protection system and based on the ratio of the amount of the fine for violation of the established requirements. The importance of accounting for the costs of personal data security to ensure the security of enterprises in the Russian Federation, taking into account the requirements of the General Data Protection Regulation, is shown. Keywords: personal data, risk assessment, budget, damage, Federal law, threat, level of maturity, system, conformity assessment. References1. REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). URL: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679. (access date 22.06.2020) 2. GDPR Fines Tracker & Statistics [Электронный ресурс]. URL: https://www.privacyaffairs.com/gdpr-fines. (access date 22.06.2020) 3. Statistics: Highest individual fines (Top 10). URL: https://www.enforcementtracker.com/?insights. (access date 22.06.2020) 4. A Very Brief Introduction to the GDPR Recitals. 2019. URL: https://www.americanbar.org/groups/litigation/committees/minority-triallawyer/practice/2019/a-very-brief-introduction-to-the-gdpr-recitals. (access date 22.06.2020) 5. Adequacy decisions. URL: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. (access date 22.06.2020) 6. About EDPB. URL: https://edpb.europa.eu/about-edpb/about-edpb_en (access date 22.06.2020) 7. Vlasov R. B. Application of the General regulation of the European Union on personal data protection to Russian companies: Problems and solutions // Business. Education. Right. 2019. № 1 (46). Pp. 383-388. 8. Mannhardt F., Petersen S.A., Oliveira M.F. Privacy challenges for process mining in human-centered industrial environments. Proceedings - 2018 International Conference on Intelligent Environments, IE 2018 14. 2018. Pp. 64-71. 9. Analysis of the possible consequences and impact of the General Data Protection Regulation (GDPR) of the European Union on the business of Russian personal data operators (telecommunications companies, Internet companies) providing services via the Internet for individuals in the EU countries in the context of current and effective regulation in the Russian Federation. - M. Institute for Internet research, 2017. 196 p. 10. Livshits I. Asset accounting when planning and conducting audits in the information security management system for compliance with the requirements of ISO/IEC 27001: 2013 // Quality management, 2014, N11, Pp. 36-39 11. Livshits I. Approaches to the assessment of information security management systems for compliance with the requirements of ISO / IEC 27001: 2013 // Quality management, 2014, N6, Pp. 41-46. 12. Livshits I. Dental software package MasterClinic. Principles of successful implementation and support / Agajanyan E. G., Lapin A.V., Livshits I. I. / / Doctor and information technologies.2007. N. 2. Pp. 50-58. 13. Besik S.I., Freytag J.-C. A formal approach to build privacy awareness into clinical workflows. Software-Intensive Cyber-Physical Systems. 2019. 14. Pikulík T., Štarchoň P. GDPR compliant methods of data protection. 6th SWS International Scientific Conferences on social sciences 2019 Conference proceedings. 2019. Pp. 561-572. 15. Laune D., Arnavielhe S., Bousquet J., Viart F., Bedbrook A., Mercier J., Lun San Luk G., deVries G., Spreux O. Adaptation of the general data protection regulation (GDPR). Revue des Maladies Respiratoires. 2019. Vol. 36. N 9. Pp. 1019-1031. 16. Lysakova L. Social media privacy: Myth or reality? 76th scientific conference of students and postgraduates of the Belarusian state University conference Materials. In 3 parts. Editorial Board: V. G. Safonov [et al.]. 2019. Pp. 595-598 17. Brodin, M. A Framework for GDPR Compliance for Small- and Medium-Sized Enterprises. Eur J Secur Res. – 2019. – 4, Pp. 243–264 doi: 10.1007/s41125-019-00042-z 18. Framework for Demonstrable GDPR Compliance. URL: https://info.nymity.com/hubfs/Landing%20Pages/GDPR%20Toolkit/ Accountability_Roadmap_for_Demonstrable_GDPR_Compliance.pdf (access date 22.06.2020) 19. Martin N., Matt C., Niebel C. et al. How Data Protection Regulation Affects Startup Innovation. Inf Syst Front 21, P. 1307–1324. – 2019. – doi:10.1007/s10796-019-09974-2. 20. Denisov I. S., Akhmatova D. R., Kabakova V. M. Comparative characteristics of GDPR and Russian legislation on personal data // Economy. Right. Society. 2019. № 1 (17). Pp. 21-27. 21. Grishina N. Yu., Boldyreva E. L., Duisembina E. O. Influence of Internet technologies on the decision-making process as a new political trend (on the example of Cambridge Analytica). Scientific and technical Bulletin of the Saint Petersburg state Polytechnic University. Humanities and social Sciences, 2019, Vol. 10, No. 1, Pp. 69-80. 22. Lăzăroiu G., Kovacova M., Kliestikova J., Kubala P., Valaskova K., Dengov V.V. Data governance and automated individual decisionmaking in the digital privacy general data protection regulation. Administratie si Management Public. 2018. Vol. 2018. № 31. Pp. 132-142. 23. Jurkevich T., Sedjakins O. International transfers of personal data. 6th SWS International Scientific Conferences on social sciences 2019 Conference proceedings. 2019. Pp. 119-126. 24. Agbozo E., Alhassan D., Spassov K. Personal data and privacy barriers to e-Government adoption, implementation and development. Communications in Computer and Information Science. 2019. Vol. 947. Pp. 82-91. 25. Livshits I. Design, creation and implementation of integrated information security systems based on ISO / IEC 27001: 2005 // Telecommunications, 2010, No. 4, Pp. 49-51. 26. Livshits I. Models and methods of audit of information security of integrated control systems for complex industrial objects: abstract of dis. ... doctor of Technical Sciences: 05.13.19 / Livshits Ilya Iosifovich; [Place of protection: Saint Petersburg Institute of Informatics and automation of the Russian Academy of Sciences], 2018. |
66-75 |
IDENTIFYING THE SIGNIFICANT FEATURES IN ILLEGAL TEXTS / N. L. Avanesyan, F. N., Solovev, E. A. Tikhomirova, A. M. Chepovskiy // Cybersecurity issues. – 2020. – № 4(38). – С. 76-84. – DOI: 10.21681/2311-3456-2020-04-76-84.
AbstractThe purpose of the study: development of a technique for determining lexical characteristics and psycholinguistic factors as discriminative features for identifying the topics of illegal texts by frequency methods for information security purposes.Method: automatic morphological and syntactic analysis, frequency methods, comparison of auto-generated dictionaries by correlation analysis methods.Results: a technique of frequency analysis of the illegal texts vocabulary has been developed, which allows to compare different sets of texts using frequency dictionaries and identify discriminative features; a technique of calculating pairwise rank correlation coefficient for comparison of frequency dictionaries of various lexical characteristics has been presented; a comparative analysis of different illegal texts collections has been carried out; the possibility of using frequency lexical characteristics to study the properties of texts in order to detect illegal resources and messages has been shown; the possibilities of using both morphological characteristics of words and word combinations and letter combinations as discriminative features have been shown; the possibility of calculating the psycholinguistic indicators of illegal texts based on automatic linguistic text analysis has been shown; the psycholinguistic characteristics for texts of various topics have been highlighted. Keywords: automated text analysis, noun phrases, rank correlation, psycholinguistics characteristics, extremist texts. References1. Hawkins, R. C. II, & Boyd, R. L. Such stuff as dreams are made on: Dream language, LIWC norms, and personality correlates. Dreaming, 2017, 27(2), 102-121. 2. Latov Y., Grishchenko L., Gaponenko V., Vasiliеv F. Mechanisms of Countering the Dissemination of Extremist Materials on the Internet // Big Data-driven World: Legislation Issues and Control Technologies. – Springer, 2019. – P. 145-162. 3. Kovalev A.K., Kuznetsova Y.M., Minin A.N., Penkina M.Y., Smirnov I.V., Stankevich M.A., Chudova N.V. Metodi viayvleniay po tekstu psikhologicheskikh kharakteristik avtora (na primere agressivnosti) // Voprosi kiberbezopasnosti.. 2019. № 4(32). С. 72-79. DOI: 10.21681/2311-3456-2019-4-72-79. (in Russian). 4. Kuzneczova, Yu. M., Smirnov, I. V., Stankevich, M. A., Chudova, N. V. Sozdanie instrumenta avtomaticheskogo analiza teksta v interesax socio-gumanitarny`x issledovanij. Chast` 2. Mashina RSA i opy`t ee ispol`zovaniya //Iskusstvenny`j intellekt i prinyatie reshenij. – 2019. – №. 3. – S. 40-51. (in Russian). 5. Smirnov I.V., Shelmanov A.O., Kuzneczova E.S., Xramoin I.V. Semantiko-sintaksicheskij analiz estestvenny`x yazy`kov. Chast` II. Metod semantiko-sintaksicheskogo analiza tekstov // Iskusstvenny`j intellekt i prinyatie reshenij. M.: ISA RAN – 2014. – №1 – S. 11-24. (in Russian). 6. Enikolopov S. N., Kuzneczova Yu. M., Smirnov I. V., Stankevich M. A., Chudova N. V. Sozdanie instrumenta avtomaticheskogo analiza teksta v interesax socio-gumanitarny`x issledovanij. Chast` 1. Metodicheskie i metodologicheskie aspekty` // Iskusstvenny`j intellekt i prinyatie reshenij. – 2019. – №. 2. – S. 28-38. 7. Enikolopov S.N. , Medvedeva T .I. , Vorontsova O.Y u. Linguistic text characteristics in depression and schizophrenia. Med. psihol. Ross., 2019, vol. 11, no. 5 (in Russian). Available at: http://mprj.ru 8. Anan’yeva M. I., Kobozeva M. V., Solov’yev F. N., Polyakov I. V., Chepovskiy A. M.. The problem of detection of extremist texts // Vestnik NSU. Series: Information Technologies. 2016. Vol. 14. № 4. S. 5-13. (in Russian). 9. Anan’yeva M. I., Devyatkin D. A., Kobozeva M. V., Smirnov I. V., Solov’yev F. N., Chepovskiy A. M. Issledovaniye harakteristik tekstov protivopravnogo soderzhaniya // Trudy Instituta sistemnogo analiza Rossiyskoy akademii nauk. 2017 T. 67 № 3 S. 86-97. (in Russian). 10. Chepovskiy A., Devyatkin D., Smirnov I., Ananyeva M., Kobozeva M., Solovyev F. Exploring linguistic features for extremist texts detection (on the material of Russian-speaking illegal texts), in: 2017 IEEE International Conference on Intelligence and Security Informatics: Security and Big Data, ISI 2017 Institute of Electrical and Electronics Engineers Inc., 2017 P. 188-190. 11. Lavrent’ev A. M., Smirnov I. V., Solovyev F. N., Suvorova M. I., Fokina A. I., Chepovskiy A. M. Sozdaniye spetsial’nyh korpusov tekstov na osnove rasshirennoy platformy TXM // Sistemy vysokoy dostupnosti. 2018. T. 14. № 3. S. 76-81. (in Russian). 12. Lavrentyev A. M., Solovyev F. N., Suvorova M. I., Fokina A. I., Chepovskiy A. M. Novyy kompleks instrumentov avtomaticheskoy obrabotki teksta dlya platformy TXM i yego aprobatsiya na korpuse dlya analiza ekstremistskih tekstov // Vestnik Novosibirskogo gosudarstvennogo universiteta. Seriya: Lingvistika i mezhkul’turnaya kommunikatsiya. 2018 T. 16 № 3 S. 19-31. (in Russian). 13. Lavrent’ev A. M., Smirnov I. V., Solovyev F. N., Suvorova M. I., Fokina A. I., Chepovskiy A. M. Analis korpusov tekstov terroristicheskoi i antipravovoy napravlennosti // Voprosi kiberbezopasnosti. 2019. № 4(32). S. 54-60. DOI: 10.21681/2311-3456-2019-4-54-60 (in Russian). 14. Lavrentyev A. M., Raybova D.M., Tikhomirova E.A., Fokina A. I., Chepovskiy A. M., Sherstinova T.Yu. Sravnitelniy analis specialnikh korpusov tekstov dlay zadach bezopasnosty // Voprosi kiberbezopasnosti.. 2020. № 3(37). С. 58-65. DOI: 10.681/2311-3456-2020-03-58-65. (in Russian). 15. Soloviev F. N. Embedding Additional Natural Language Processing Tools into the TXM Platform. Vestnik NSU. Series: Information Technologies, 2020, vol. 18, no. 1, p. 74–82. (in Russian) 16. Chepovskiy A. M. Informatsionnyye modeli v zadachah obrabotki tekstov na yestestvennyh yazykah. Vtoroye izdaniye, pererabotannoye. M.: Natsional›nyy otkrytyy niversitet “INTUIT”, 2015. (in Russian).на основе следующих параметров: |
76-84 |
Leave a Reply