№ 1 (47)

Content of the 1st issue of magazine «Voprosy kiberbezopasnosti» at 2022:

Title Pages
Markov, A. S. CYBERSECURITY AND INFORMATION SECURITY AS NOMENCLATURE BIFURCATION SCIENTIFIC SPECIALTIES (RUSSIAN TEXT) / A. S. Markov // Cybersecurity issues. – 2022. – № 1(47). – С. 2-22. – DOI: 10.21681/2311-3456-2022-1-2-9.

2-9
Aladjev, V. Z. THE MAIN STAGES OF THE CELLULAR AUTOMATA THEORY FORMATION / V. Z. Aladjev // Cybersecurity issues. – 2022. – № 1(47). – С. 10-17. – DOI: 10.21681/2311-3456-2022-1-10-17.
Abstract
Paper presents our standpoint on the main stages of the cellular automata theory formation, based on our many years of research in this eld. Along with English-speaking authors, the results of Soviet and Russian authors are presented, who made a fairly signi cant contribution to the theory of cellular automata, emphasizing a rather essential contribution of domestic researchers in this direction. Finally, our standpoint is presented on the place of the problematics of cellular automata in the system of modern natural science.
Keywords: cellular automata, homogeneous structures, modelling, parallel processing, reversibility, automata theory, computing models.
References
1. Mathematical Problems in Biology / Ed. R. Bellman.– New–York: Academic Press, 1962.
2. V.Z. Aladjev. To the Theory of the Homogeneous Structures.– Tallinn: Estonian Academic Press, 1972 (in Russian).
3. Links https://files.portalus.ru/dl/files/Our_publications_2019.pdf and https://files.portalus.ru/dl/files/TRG.html
4. V.Z. Aladjev. Mathematical theory of homogeneous structures and their applications.– Tallinn: Valgus Press, 1980, 270 p.
5. V.Z. Aladjev. Homogeneous Structures: Theoretical and Applied Aspects.– Kiev: Technika Press, 1990 (in Russian).
6. V.Z. Aladjev. Classical homogeneous structures: Cellular Automata.– USA: Palo Alto: Fultus Books, 2009, 535 p., ISBN 159682137X
7. V.Z. Aladjev. Classical Cellular Automata: Mathematical Theory and Applications.– Germany: Saarbrucken: Scholar`s Press, 2014, 512 p.
8. V.Z. Aladjev, M.L. Shishakov, V.A. Vaganov. Selected problems in the theory of classical cellular automata.– USA: Lulu Press, 2018, 410 p.
9. В.З. Аладьев, В.А. Ваганов, М.Л. Шишаков. Базовые элементы теории клеточных автоматов.– USA: Lulu Press, 2019, 418 c.
10. Links on the CA–problematics – http://www.hs-ca.narod.ru, or http://ca-hs.weebly.com
11. S. Wolfram. A New Kind of Science.– N.Y.: Wolfram Media, 2002.
12. Interview on the CA problematics – https://all-andorra.com/ru/viktor-aladev-o-bazovyx-elementax-odnorodnyx-struktur-i-teoriikletochnyx-avtomatov (in Russian)
10-17
Moldovyan, D. N. A NEW CONCEPT FOR DESIGNING POST-QUANTUM DIGITAL SIGNATURE ALGORITHMS ON NON-COMMUTATIVE ALGEBRAS / D. N. Moldovyan, A. A. Moldovyan, N. A. Moldovyan // Cybersecurity issues. – 2022. – № 1(47). – С. 18-25. – DOI: 10.21681/2311-3456-2022-1-18-25.
Abstract
Purpose of work is the development of a new approach to designing post-quantum digital signature algorithms that are free from the shortcomings of known analogs - large sizes of the signature and public key.Research method is the use of power vector equations with multiple occurrences of the signature S as a signature veri cation equation. The computational dif culty of solving equations of the said type relatively the unknown value of S ensures the resistance of the signature scheme to attacks using S as a tting parameter. The possibility of calculating the value of S by the secret key is provided by using the public key in the form of a set of secret elements of the hidden group, masked by performing left and right multiplications by matched invertible vectors.Results of the study include a new proposed concept for the development of post-quantum digital signature algorithms on non-commutative algebras, which use a hidden commutative group. One of its main differences is the use of a secret key in the form of a set of vectors, the knowledge of which makes it possible to calculate the correct signature value for the random powers present in the veri cation equation. The form of the latter de nes a system of quadratic vector equations connecting the public key with the secret, which is reduced to a system of many quadratic equations with many unknowns, given over a nite eld. The computational dif culty of nding a solution to the latter system determines the security of the algorithms developed within the framework of the proposed concept. A quantum computer is ineffective for solving this problem, therefore, the said algorithms are post-quantum. As analogs in construction, digital signature algorithms based on the computational dif culty of the hidden discrete logarithm problem are considered, however, the use of a hidden group and exponentiation operations represent only a general technique for ensuring the correctness of the signature schemes developed within the framework of the concept, and not for specifying a basic computationally dif cult problem. To improve the performance of the signature generation and veri cations procedures, the four-dimensional algebras de ned by sparse basis vector multiplication tables are used as an algebraic support. The proposed concept is con rmed by the development of a speci c post-quantum algorithm that provides a signi cant reduction in the size of the public key and signature in comparison with the nalists of the NIST global competition in the nomination of post-quantum digital signature algorithms.Practical relevance: The developed new concept for constructing post-quantum digital signature algorithms expands the areas of their application in conditions of limited computing resources.
Keywords: finite non-commutative algebra; associative algebra; computationally difficult problem; discrete logarithm; hidden commutative group; digital signature; multivariate cryptography; post-quantum cryptography.
References
1. Alamelou, Q., O. Blazy, S. Cauchie, and Ph. Gaborit. A code-based group signature scheme. Designs, Codes and Cryptography. 2017, vol. 82, no. 1−2, pp, 469−493.
2. Agibalov G.P. ElGamal cryptosystems on Boolean functions. Prikl. Diskr. Mat. 2018, no. 42, pp. 57−65. DOI: 10.17223/20710410/42/4.
3. Hoffstein J., Pipher J., Schanck J.M., Silverman J.H., Whyte W., Zhang Zh. Choosing parameters for NTRU Encrypt. Cryptographers’ Track at the RSA Conference - CTA-RSA 2017. Springer LNCS. 2017, vol. 10159, pp. 3 18.
4. Announcing Request for Nominations for Public-Key Post-Quantum Cryptographic Algorithms. Federal Register, December 20, 2016. Vol. 81. No. 244. P. 92787–92788. Available at: https://www.gpo.gov/fdsys/pkg/FR-2016-12-20/pdf/2016-30615.pdf (accessed December 4, 2021).
5. Moody, D. 2021. NIST Status Update on the 3rd Round. Available at: https://csrc.nist.gov/CSRC/media/Presentations/status-updateon-the-3rd-round/images-media/session-1-moody-nist-round-3-update.pdf (accessed December 4, 2021).
6. Kuzmin A.S., Markov V.T., Mikhalev A.A., Mikhalev A.V., Nechaev A.A. Cryptographic Algorithms on Groups and Algebras. Journal of Mathematical Sciences. 2017, vol. 223, no 5, pp. 629–641.
18-25
Solodukha, R. A. STATISTICAL STEGANALYSIS OF PHOTOREALISTIC IMAGES USING GRADIENT PATHS / R. A. Solodukha // Cybersecurity issues. – 2022. – № 1(47). – С. 26-36. – DOI: 10.21681/2311-3456-2022-1-26-36.
Abstract

Keywords: digital information, Information space, Cyberspace, Digital technology, Cyber threats, Cyber-Physical Systems (CPS).
References
26-36
Klyucharev, P. G. CELLULAR AUTOMATA AND THEIR GENERALIZATIONS IN CRYPTOGRAPHY. PART 2. / P. G. Klyucharev // Cybersecurity issues. – 2022. – № 1(47). – С. 37-48. – DOI: 10.21681/2311-3456-2022-1-37-48.
Abstract
The purpose of the article is an analytical review of the application of cellular automata and their generalizations in cryptography.Research method: an analysis of scienti c publications on the topic of the article.Results: The review article analyzes the literature devoted to the use of cellular automata and their generalizations for the construction of cryptographic algorithms. The article consists of two parts.The rst part was devoted to classical cellular automata and symmetric cryptographic algorithms based on them. It brie y discussed the history of the theory of cellular automata and its application in various scienti c elds. A review of the works of a number of authors who proposed symmetric cryptographic algorithms and pseudorandom sequence generators based on one-dimensional cellular automata was presented. The security of such cryptographic algorithms turned out to be insuf cient. The following was a review of articles devoted to the use of two-dimensional cellular automata for constructing ciphers (this approach gave the best results). Multidimensional cellular automata were also mentioned.This second part of the article is devoted to a review of works devoted to the use of generalized cellular automata in cryptography - on the basis of such automata, it is possible to create symmetric encryption algorithms and cryptographic hash functions that provide a high level of security and high performance in hardware implementation (for example, on FPGA), as well as having fairly low requirements for hardware resources. In addition, an attention is paid to interesting connections of generalized cellular automata, in the context of their use in cryptography, with the theory of expander graphs. Attention is also paid to the security of cryptographic algorithms based on generalized cellular automata. The works devoted to the implementation of various cryptographic algorithms based on generalized cellular automata on FPGA and GPU are mentioned. In addition, an overview of asymmetric cryptoalgorithms based on cellular automata is given. The questions about the belonging of some problems on cellular automata and their generalizations to the class of NP-complete problems, as well as to some other complexity classes, are also considered.
Keywords: cellular automation, generalized cellular automation, stream cipher, block cipher, hash function, Ramanujan graph, public-key cryptography.
References
1. Kauffman S. A. Metabolic stability and epigenesis in randomly constructed genetic nets // Journal of theoretical biology. – 1969. – Vol. 22, No. 3. – P. 437–467.
2. Aldana M., Coppersmith S., Kadanoff L. P. Boolean dynamics with random couplings // Perspectives and Problems in Nolinear Science. – Springer, 2003. – P. 23–89.
3. Gershenson C. Introduction to random boolean networks // arXiv preprint nlin/0408006. – 2004.
4. Bilke S., Sjunnesson F. Stability of the Kauffman model // Physical Review E. – 2001. – Vol. 65, No. 1. – P. 016129.
5. Socolar J. E., Kauffman S. A. Scaling in ordered and critical random boolean networks // Physical review letters. – 2003. – Vol. 90, No. 6. – P. 068702–1–068702–4.
6. Samuelsson B., Troein C. Superpolynomial growth in the number of attractors in Kauffman networks // Physical Review Letters. – 2003. – Vol. 90, No. 9. – P. 098701.
7. Mihaljev T., Drossel B. Scaling in a general class of critical random boolean networks // Physical Review E. – 2006. – Vol. 74, No. 4. – P. 046101.
8. Klyucharev P. G. Obespechenie kriptograficheskix svojstv obobshhyonny’x kletochny’x avtomatov // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2012. – № 3. – Rezhim dostupa: http://technomag.edu.ru/doc/358973.html.
9. Suxinin B. M. Razrabotka i issledovanie vy’sokoskorostny’x generatorov psevdosluchajny’x ravnomerno raspredelenny’x dvoichny’x posledovatel’nostej na osnove kletochny’x avtomatov: Dis… kand. texn. nauk: 05.13.17 / Boris Mixajlovich Suxinin ; MGTU im. N.E’. Baumana. – M., 2011. – 224 s.
10. Suxinin B. M. Primenenie klassicheskix i neodnorodny’x kletochny’x avtomatov pri postroenii vy’sokoskorostny’x generatorov psevdosluchajny’x posledovatel’nostej // Proektirovanie i texnologiya e’lektronny’x sredstv. – 2009. – № 3. – S. 47–51.
11. Klyucharev P. G. O periode obobshhyonny’x kletochny’x avtomatov // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2012. – № 2. – Rezhim dostupa: http://technomag.edu.ru/doc/340943.html.
12. Klyucharev P. G. Ob ustojchivosti obobshhenny’x kletochny’x avtomatov k nekotory’m tipam kollizij // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2014. – № 9. – S. 194–202. – Rezhim dostupa: http://technomag.edu.ru/doc/727086.html.
13. Klyucharev P. G. Kletochny’e avtomaty’, osnovanny’e na grafax Ramanudzhana, v zadachax generacii psevdosluchajny’x
posledovatel’nostej // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2011. – № 10. – Rezhim dostupa: http://
www.technomag.edu.ru/doc/241308.html.
14. Klyucharev P. G. Postroenie psevdosluchajny’x funkcij na osnove obobshhyonny’x kletochny’x avtomatov // Nauka i obrazovanie. MGTU
im. N.E’. Baumana. E’lektron. zhurn. – 2012. – № 10. – S. 263–274.
15. Klyucharev P. G. Blochny’e shifry’, osnovanny’e na obobshhyonny’x kletochny’x avtomatax // Nauka i obrazovanie. MGTU im. N.E’.
Baumana. E’lektron. zhurn. – 2012. – № 12. – S. 361–374. – Rezhim dostupa: http://engineering-science.ru/doc/517543.html.
16. Zhukov A. E. Kletochny’e avtomaty’ v kriptografii. chast’ 2 // Voprosy’ kiberbezopasnosti. – 2017. – № 4(22). – S. 47–66.
17. Klyucharev P. G. Kriptograficheskie xe’sh-funkcii, osnovanny’e na obobshhyonny’x kletochny’x avtomatax // Nauka i obrazovanie.
MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2013. – № 1. – S. 161–172.
18. Klyucharev P. G. Metod postroeniya kriptograficheskix xe’sh-funkcij na osnove iteracij obobshhennogo kletochnogo avtomata //
Voprosy’ kiberbezopasnosti. – 2017. – № 1(19). – S. 45–50.
19. Klyucharev P. G. Postroenie algoritmov vy’rabotki imitovstavok na osnove obobshhyonny’x kletochny’x avtomatov // Nauka i
obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2016. – № 11. – S. 142–152. – Rezhim dostupa: http://engineeringscience.ru/doc/849590.html.
20. Hoory S., Linial N., Wigderson A. Expander graphs and their applications // Bulletin of the American Mathematical Society. – 2006. –
Vol. 43, No. 4. – P. 439–562.
21. Klyucharev P. G. Determinirovanny’e metody’ postroeniya grafov Ramanudzhana, prednaznachenny’x dlya primeneniya v
kriptograficheskix algoritmax, osnovanny’x na obobshhyonny’x kletochny’x avtomatax // Prikladnaya diskretnaya matematika. –
2018. – № 42. – S. 76–93.
22. Klyucharev P. G. Postroenie sluchajny’x grafov, prednaznachenny’x dlya primeneniya v kriptograficheskix algoritmax, osnovanny’x na
obobshhenny’x kletochny’x avtomatax // Matematika i matematicheskoe modelirovanie. – 2017. – No 3. – S. 77–90. – Rezhim
dostupa: https://www.mathmelpub.ru/jour/article/view/76.
23. Pizer A. K. Ramanujan graphs and Hecke operators // Bulletin of the American Mathematical Society. – 1990. – Vol. 23, No. 1. – P.
127–137.
24. Charles D., Lauter K., Goren E. Cryptographic hash functions from expander graphs // J. Cryptology. – 2009. – Vol. 22, No. 1. – P.
93–113.
25. Petit C. On Graph-Based Cryptographic Hash Functions: Ph. D. thesis / C. Petit ; Catholic University of Louvain. – 2009. – 286 p.
26. Ramanujan graphs in cryptography / Anamaria Costache, Brooke Feigon, Kristin Lauter et al. // Research Directions in Number
Theory. – Springer, 2019. – P. 1–40.
27. Adj G., Ahmadi O., Menezes A. On isogeny graphs of supersingular elliptic curves over finite fields // Finite Fields and Their Applications. –
2019. – Vol. 55. – P. 268–283.
28. Sarnak P. Some applications of modular forms. – Cambridge University Press, 1990. – Vol. 99. – 111 p.
29. De Feo L., Jao D., Plut J. Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies // Journal of Mathematical
Cryptology. – 2014. – Vol. 8, No. 3. – P. 209–247.
30. Postkvantovy’j kriptograficheskij protokol vy’rabotki obshhego klyucha, osnovanny’j na izogeniyax supersingulyarny’x e’llipticheskix krivy’x / S. V. Grebnev, P. G. Klyucharev, A. M. Koreneva i dr. // Bezopasny’e informacionny’e texnologii. Sbornik trudov XI mezhdunarodnoj nauchno-texnicheskoj konferencii. – M.: MGTU im. N.E’. Baumana, 2021. – S. 99–103.
31. Klyucharev P. G. Issledovanie stojkosti blochny’x shifrov, osnovanny’x na obobshhenny’x kletochny’x avtomatax, k linejnomu kriptoanalizu // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2013. – No 5. – S. 235–246. – Rezhim dostupa: http://engineering-science.ru/doc/574231.html.
32. Klyucharev P. G. Kvantovy’e vy’chisleniya i ataki na kriptoalgoritmy’, osnovanny’e na obobshhenny’x kletochny’x avtomatax // Bezopasny’e informacionny’e texnologii. Sbornik trudov Vos’moj vserossijskoj nauchno-texnicheskoj konferencii. – M.: MGTU im. N.E’. Baumana, 2017. – S. 234–236.
33. Klyucharev P. G. Issledovanie prakticheskoj vozmozhnosti resheniya svyazanny’x s kriptoanalizom zadach na obobshhenny’x kletochny’x avtomatax algebraicheskimi metodami // Matematika i matematicheskoe modelirovanie. – 2017. – No 5. – S. 29–44.
34. Klyucharev P. G. Issledovanie prakticheskoj vozmozhnosti resheniya odnoj zadachi na obobshhenny’x kletochny’x avtomatax s ispol’zovaniem SAT-reshatelej // Mashinostroenie i komp’yuterny’e texnologii. – 2018. – № 11. – S. 11–22. – Rezhim dostupa: https://www.elibrary.ru/item.asp?id=37315433.
35. Klyucharev P. G. Proizvoditel’nost’ i e’ffektivnost’ apparatnoj realizacii potochny’x shifrov, osnovanny’x na obobshhenny’x kletochny’x avtomatax // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2013. – No 10. – S. 299–314. – Rezhim dostupa: http://engineering-science.ru/doc/624722.html.
36. Klyucharev P. G. Realizaciya kriptograficheskix xe’sh-funkcij, osnovanny’x na obobshhenny’x kletochny’x avtomatax, na baze PLIS: proizvoditel’nost’ i e’ffektivnost’ // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2014. – No 1. – S. 214–223. – Rezhim dostupa: http://engineering-science.ru/doc/675812.html.
37. De Canniere C. Trivium: A stream cipher construction inspired by block cipher design principles // Information Security. – Springer, 2006. – P. 171–186.
38. Klyucharev P. G. Proizvoditel’nost’ potochny’x shifrov, osnovanny’x na kletochny’x avtomatax, pri realizacii na graficheskix processorax // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2016. – No 6. – S. 200–213. – Rezhim dostupa: http://engineeringscience.ru/doc/842091.html.
39. Klyucharev P. G. Proizvoditel’nost’ drevovidny’x kriptograficheskix xe’sh-funkcij, osnovanny’x na kletochny’x avtomatax, pri ix realizacii na graficheskix processorax // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2016. – No 10. – S. 132–142. –
Rezhim dostupa: http://engineering-science.ru/doc/847891.html.
40. Klyucharev P. G. O proizvoditel’nosti blochny’x shifrov, osnovanny’x na kletochny’x avtomatax, pri ix realizacii na graficheskix processorax // Radiooptika. – 2016. – No 6. – S. 24–34.
41. Shihua T. R. C. A finite automaton public key cryptosystem and digital signatures [j] // Chinese Journal of Computers. – 1985. – Vol. 6.
42. Agibalov G. Konechny’e avtomaty’ v kriptografii // Prikladnaya diskretnaya matematika. – 2009. – № Prilozhenie k No 2. – S. 43–73.
43. Bao F., Igarashi Y. Break finite automata public key cryptosystem // International Colloquium on Automata, Languages, and Programming / Springer. – 1995. – P. 147–158. 
44. Dai Z. D., Ye D. F., Lam K. Y. Weak invertibility of finite automata and cryptanalysis on FAPKC // International Conference on the Theory
and Application of Cryptology and Information Security / Springer. – 1998. – P. 227–241.
45. Kari J. Cryptosystems based on reversible cellular automata // Manuscript, August. – 1992.
46. Clarridge A., Salomaa K. A cryptosystem based on the composition of reversible cellular automata // International Conference on Language and Automata Theory and Applications / Springer. – 2009. – P. 314–325.
47. Santos T. Cellular automata and cryptography // Dissertao de Mestrado apresentada Faculdade de Cincias da Universidade do Porto em Cincia de Computadores. – 2014.
48. Guan P. Cellular automaton public-key cryptosystem // Complex Systems. – 1987. – Vol. 1. – P. 51–57.
49. A new public key encryption scheme based on layered cellular automata / Xing Zhang, Rongxing Lu, Hong Zhang, Chungen Xu // KSII Transactions on Internet and Information Systems (TIIS). – 2014. – Vol. 8, No. 10. – P. 3572–3590.
50. Chilikov A. A., Zhukov A. E., Verxovskij A. I. Issledovanie obratimy’x kletochny’x avtomatov s konechnoj reshetkoj // Bezopasny’e informacionny’e texnologii. Sbornik trudov Desyatoj mezhdunarodnoj nauchno-texnicheskoj konferencii. – M.: MGTU im. N.E’. Baumana, 2019. – S. 354–360.
51. Zhukov A. E. Kletochny’e avtomaty’ i zaprety’ bulevy’x funkcij // Bezopasny’e informacionny’e texnologii. Sbornik trudov XI mezhdunarodnoj nauchno-texnicheskoj konferencii. – M.: MGTU im. N.E’. Baumana, 2021. – S. 108–119.
52. Arora S., Barak B. Computational Complexity: A Modern Approach. – Cambridge University Press, 2009. – 594 p.
53. Green F. NP-complete problems in cellular automata // Complex Systems. – 1987. – Vol. 1, No. 3. – P. 453–474.
54. Sutner K. Additive automata on graphs // Complex Systems. – 1988. – Vol. 2, No. 6. – P. 649–661.
55. Clementi A., Impagliazzo R. The reachability problem for finite cellular automata // Information processing letters. – 1995. – Vol. 53, No. 1. – P. 27–31.
56. Klyucharev P. G. NP-trudnost’ zadachi o vosstanovlenii predy’dushhego sostoyaniya obobshhennogo kletochnogo avtomata // Nauka i obrazovanie. MGTU im. N.E’. Baumana. E’lektron. zhurn. – 2012. – No 1. – Rezhim dostupa: http://technomag.edu.ru/doc/312834.html.
57. Klyucharev P.G. Kletochnye avtomaty i ih obobshcheniya v zadachah kriptografii. CHast 1. Voprosy kiberbezopasnosti [Cybersecurity issues]. 2021. No 6 (46), pp. 90-101. DOI: 10.21681/2311-3456-2021-6-90-101.
37-48
AUTOMATIC DETECTION OF ACCESS CONTROL VULNERABILITIES VIA API SPECIFICATION PROCESSING / A. V. Barabanov, D. O. Dergunov, D. N. Makrushin, A. N. Teplov // Cybersecurity issues. – 2022. – № 1(47). – С. 49-65. – DOI: 10.21681/2311-3456-2022-1-49-65.
Abstract
Objective. Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) are one of the critical type of access control vulnerabilities for modern applications. As a result, an attacker can bypass authorization checks leading to information leakage, account takeover. Our main research goal was to help an application security architect to optimize security design and testing process by giving an algorithm and tool that allows to automatically analyze system API speci cations and generate list of possible vulnerabilities and attack vector ready to be used as security non-functional requirements.Method. We conducted a multivocal review of research and conference papers, bug bounty program reports and other grey sources of literature to outline patterns of attacks against IDOR vulnerability. These attacks are collected in groups proceeding with further analysis common attributes between these groups and what features compose the group. Endpoint properties and attack techniques comprise a group of attacks. Mapping between group features and existing OpenAPI speci cations is performed to implement a tool for automatic discovery of potentially vulnerable endpoints.Results and practical relevance. In this work, we provide systematization of IDOR/BOLA attack techniques based on literature review, real cases analysis and derive IDOR/BOLA attack groups. We proposed an approach to describe IDOR/BOLA attacks based on OpenAPI speci cations properties. We develop an algorithm of potential IDOR/BOLA vulnerabilities detection based on OpenAPI speci cation processing. We implemented our novel algorithm using Python and evaluated it. The results show that algorithm is resilient and can be used in practice to detect potential IDOR/BOLA vulnerabilities.
Keywords:  microservices, security, threat modeling, REST API, Insecure Direct Object Reference, Broken object level authorization, access control vulnerability.
References
1. V. Atlidakis, P. Godefroid and M. Polishchuk, “RESTler: Stateful REST API Fuzzing,” 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), 2019, pp. 748-758. DOI: 10.1109/ICSE.2019.00083.
2. V. Atlidakis, P. Godefroid and M. Polishchuk, “Checking Security Properties of Cloud Service REST APIs,” 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), 2020, pp. 387-397. DOI: 10.1109/ICST46399.2020.00046.
3. E. Viglianisi, M. Dallago and M. Ceccato, “RESTTESTGEN: Automated Black-Box Testing of RESTful APIs,” 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), 2020, pp. 142-152. DOI: 10.1109/ICST46399.2020.00024.
4. S. Karlsson, A. Čaušević and D. Sundmark, “QuickREST: Property-based Test Generation of OpenAPI-Described RESTful APIs,” 2020 IEEE 13th International Conference on Software Testing, Validation and Verification (ICST), 2020, pp. 131-141. DOI: 10.1109/ICST46399.2020.00023.
5. S. Karlsson, A. Čaušević and D. Sundmark, “Automatic Property-based Testing of GraphQL APIs,” 2021 IEEE/ACM International Conference on Automation of Software Test (AST), 2021, pp. 1-10. DOI: 10.1109/AST52587.2021.00009.
6. N. Laranjeiro, J. Agnelo and J. Bernardino, “A Black Box Tool for Robustness Testing of REST Services,” in IEEE Access, vol. 9, pp. 24738-24754, 2021. DOI: 10.1109/ACCESS.2021.3056505.
7. A. Arcuri, “Automated Black- and White-Box Testing of RESTful APIs With EvoMaster,” in IEEE Software, vol. 38, no. 3, pp. 72-78, MayJune 2021. DOI: 10.1109/MS.2020.3013820.
8. Viriya, Anthony, and Yohan Muliono. “Peeking and Testing Broken Object Level Authorization Vulnerability onto E-Commerce and
E-Banking Mobile Applications.” Procedia Computer Science 179 (2021): 962-965.
9. Laurens Sion, Koen Yskout, Dimitri Van Landuyt, and Wouter Joosen. 2018. Solution-aware data flow diagrams for security threat
modeling. In Proceedings of the 33rd Annual ACM Symposium on Applied Computing (SAC ‘18). Association for Computing Machinery,
New York, NY, USA, 1425–1432. DOI: 10.1145/3167132.3167285
10. Laurens Sion, Koen Yskout, Dimitri Van Landuyt, Alexander van den Berghe, and Wouter Joosen. 2020. Security Threat Modeling: Are Data Flow Diagrams Enough? In Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops (ICSEW’20). Association for Computing Machinery, New York, NY, USA, 254–257. DOI: 10.1145/3387940.3392221
11. Katja Tuma, Laurens Sion, Riccardo Scandariato, and Koen Yskout. 2020. Automating the early detection of security design flaws. In Proceedings of the 23rd ACM/IEEE International Conference on Model Driven Engineering Languages and Systems (MODELS ‘20).
Association for Computing Machinery, New York, NY, USA, 332–342. DOI: 10.1145/3365438.3410954
12. Seungoh Choi, Jeong-Han Yun, and Byung-Gil Min. 2021. Probabilistic Attack Sequence Generation and Execution Based on MITRE ATT&CK for ICS Datasets. In Cyber Security Experimentation and Test Workshop (CSET ‘21). Association for Computing Machinery, New York, NY, USA, 41–48. DOI: 10.1145/3474718.3474722
13. M. Vanamala, J. Gilmore, X. Yuan and K. Roy, “Recommending Attack Patterns for Software Requirements Document,” 2020 International Conference on Computational Science and Computational Intelligence (CSCI), 2020, pp. 1813-1818. DOI: 10.1109/CSCI51800.2020.00334.
14. C. Wilhjelm and A. A. Younis, “A Threat Analysis Methodology for Security Requirements Elicitation in Machine Learning Based Systems,” 2020 IEEE 20th International Conference on Software Quality, Reliability and Security Companion (QRS-C), 2020, pp. 426-433. DOI: 10.1109/QRS-C51114.2020.00078.
15. Fredj O.B., Cheikhrouhou O., Krichen M., Hamam H., Derhab A. (2021) An OWASP Top Ten Driven Survey on Web Application Protection Methods. In: Garcia-Alfaro J., Leneutre J., Cuppens N., Yaich R. (eds) Risks and Security of Internet and Systems. CRiSIS 2020. Lecture Notes in Computer Science, vol 12528. Springer, Cham. DOI: 10.1007/978-3-030-68887-5_14
16. Pereira-Vale, A., Fernandez, E.B., Monge, R., Astudillo, H., Márquez, G., 2021. Security in microservice-based systems: A multivocal literature review. Comput. Secur. 103, 102200. DOI: 10.1016/j.cose.2021.102200
17. Chris Richardson, “Microservices patterns: with examples in Java,” ed. Switzerland, Europe: Manning Publications, 2019. 490 p.
18. F. Osses, G. Marquez, and H. Astudillo, “An exploratory study of academic architectural tactics and patterns in microservices: A systematic literature review,” in Avances en Ingenieria de Software a Nivel Iberoamericano, CIbSE 2018, 2018.
19. N. Alshuqayran, N. Ali, and R. Evans, “A systematic mapping study in microservice architecture,” in 2016 IEEE 9th International Conference on Service-Oriented Computing and Applications (SOCA). IEEE, 2016.
20. N. Chondamrongkul, J. Sun and I. Warren, “Automated Security Analysis for Microservice Architecture,” 2020 IEEE International Conference on Software Architecture Companion (ICSA-C), 2020, pp. 79-82. DOI: 10.1109/ICSA-C50368.2020.00024.
21. Zhidkov I.V., Zubarev I.V., Khabibullin I.V. Choosing a Rational Model for Development Secure Software. Cybersecurity issues (Voprosy kiberbezopasnosti). 2021. № 5(45). pp. 21-29. DOI: 10.21681/2311-3456-2021-5-21-29
49-65

Gryzunov, V. V. SELECTING THE MOST DANGEROUS VULNERABILITIES FOR PROSPECTIVE INFORMATION SYSTEMS FOR CRITICAL APPLICATIONS / V. V. Gryzunov, A. A. Grishechko, D. E. Sipovich // Cybersecurity issues. – 2022. – № 1(47). – С. 66-75. – DOI: 10.21681/2311-3456-2022-1-66-75.

Abstract
The development of information systems of critical application is ahead of changes in regulatory documents of regulators and educational programs of universities. Purpose of work: to determine the most dangerous vulnerabilities for promising information systems of critical application (IS CA). Research method: application of the analysis hierarcihes method to compile a hierarchy of alternatives, including the type of platform for a promising IS CA, aspects of information security, types of vulnerabilities. Conducting a survey of experts using a point assessment. Converting results to a matrix of pairwise comparisons. Getting local and global priorities of alternatives. Result of the study: 25 experts of different ages and with different work experience were interviewed. From the point of view of the interviewed specialists, the best type of platform for a prospective distributed information system of critical application is edge computing. Availability, authenticity and integrity are highlighted as the most important aspects of information security. The most dangerous are the vulnerabilities associated with: 1) incomplete veri cation of input (input) data, buffer over ow, the possibility of injections, injection of arbitrary code, cross-site scripting, injection of operating system commands, etc.; 2) identi cation, authentication, granting access and privilege escalation; 3) incorrect con guration of software parameters, management of system resources, access to service information. Less dangerous are vulnerabilities that use the health of hardware and reduce its resistance to the actions of technical means of reconnaissance and electronic warfare. The results can be used to prioritize the procurement of information security products, to update the regulatory framework of regulators and training programs for training information security specialists.
Keywords: edge computing, fog computing, cloud computing, information security, distributed information system,
expert assessments.
References
1. Burlov V. G., Gry’zunov V. V., Sipovich D. E. Adaptivnoe upravlenie dostupnost’yu v geoinformacionnoj sisteme, ispol’zuyushhej tumanny’e vy’chisleniya // International Journal of Open Information Technologies. 2021. T. 9. № 9. S. 74—87.
2. Viswanathan G., Jayagopal P. A Threat Categorization of Risk-Based approach for analyzing Security Threats early phase in SDLC // Arabian Journal for Science and Engineering. 2021. S. 1—13. DOI: 10.1007/s13369-021-05602-x.
3. Gribanova-Podkina M. Yu. Postroenie modeli ugroz informacionnoj bezopasnosti informacionnoj sistemy’ s ispol’zovaniem metodologii ob”ektno-orientirovannogo proektirovaniya //Voprosy’ bezopasnosti. 2017. №. 2. DOI: 10.7256/2409-7543.2017.2.22065.
4. Abramova T. V., Aralbaev T. Z. Analiz prostranstvenno-vremennoj modeli ugroz dlya raspredelennoj avtomatizirovannoj sistemy’ upravleniya processom transportirovki neftegazovogo sy’r’ya //Vestnik Ufimskogo gosudarstvennogo aviacionnogo texnicheskogo universiteta. 2020. T. 24. №. 1 (87). S. 76—84.
5. Vasil’ev V. I. i dr. Metodika ocenki aktual’ny’x ugroz i uyazvimostej na osnove texnologij kognitivnogo modelirovaniya i Text Mining // Sistemy’ upravleniya, svyazi i bezopasnosti. 2021. №. 3. S. 110—134.
6. Chernov D. V., Sy’chugov A. A. Formalizovannoe predstavlenie modeli ugroz informacionnoj bezopasnosti ASU TP //Radiotexnika. 2019. T. 83. №. 6. S. 74—80. DOI: 10.18127/j00338486-201906(7)-13.
7. Llansó T., McNeil M., Noteboom C. Multi-criteria selection of capability-based cybersecurity solutions //Proceedings of the 52nd Hawaii International Conference on System Sciences. 2019. DOI: 10.24251/HICSS.2019.879.
8. Hadarics K. et al. Improving distributed vulnerability assessment model of cybersecurity //Central and Eastern European eDem and eGov Days. 2018. T. 331. S. 385—393. DOI: 10.24989/ocg.v331.32.
9. Breier J., Hudec L. New approach in information system security evaluation //2012 IEEE First AESS European Conference on Satellite Telecommunications (ESTEL). IEEE, 2012. S. 1—6. DOI: 10.1109/ESTEL.2012.6400145.
10. Tariq M. I. et al. Prioritization of information security controls through fuzzy AHP for cloud computing networks and wireless sensor networks //Sensors. 2020. T. 20. №. 5. S. 1310. DOI: 10.3390/s20051310.
11. Saaty T. L. Decision making with the analytic hierarchy process //International journal of services sciences. 2008. T. 1. №. 1. S. 83—98. DOI:10.1504/IJSSCI.2008.017590.
12. Gry’zunov V. V. Konceptual’naya model’ adaptivnogo upravleniya geoinformacionnoj sistemoj v usloviyax destabilizacii // Problemy’ informacionnoj bezopasnosti. Komp’yuterny’e sistemy’. 2021. № 1(45). S. 102—108.
13. Gry’zunov V. V. Model’ geoinformacionnoj sistemy’ FIST, ispol’zuyushhej tumanny’e vy’chisleniya v usloviyax destabilizacii //Vestnik Dagestanskogo gosudarstvennogo texnicheskogo universiteta. Texnicheskie nauki. 2021. T. 48. №. 1. S. 76—89. DOI: 10.21822/2073-6185-2021-48-1-76-89. 14. Burlov V. G., Gryzunov V. V., Tatarnikova T. M. Threats of information security in the application of GIS
in the interests of the digital economy //Journal of Physics: Conference Series. IOP Publishing. 2020. T. 1703. №. 1. S. 012023. DOI:10.1088/1742-6596/1703/1/012023.
14. Gry’zunov V. V. Metod dinamicheskogo formirovaniya pulov v informacionno-vy’chislitel’ny’x sistemax voennogo naznacheniya // Informacionno-upravlyayushhie sistemy’. 2015. №. 1 (74). DOI; 10.15217/issn1684-8853.2015.1.13.
15. Gry’zunov V. V. Metodika resheniya izmeritel’ny’x i vy’chislitel’ny’x zadach v usloviyax degradacii informacionno-vy’chislitel’noj sistemy’ //Vestnik SibGUTI. 2015. №. 1. S. 35—46.

66-75
Zakalkin, P. V. EVOLUTION OF CYBERSPACE MANAGEMENT SYSTEMS / P. V. Zakalkin // Cybersecurity issues. – 2022. – № 1(47). – С. 76-86. – DOI: 10.21681/2311-3456-2022-1-76-86.
Abstract
The purpose of the study: to identify the main systems that control cyberspace and the key elements whose management will allow controlling a given segment of cyberspace.Research method: theory of complex systems; synergetic.Result: The paper considers the main control systems that play a key role in the management of cyberspace, highlights the structural elements of cyberspace and their interrelations with each other. Regional and local Internet registrars are considered, their coherence graph is presented, as well as the coherence graph by country. Based on the study, the author's vision of the organizational structure of the cyberspace management system (in relation to domain names and IP addresses). Autonomous systems and traf c exchange points are considered, the structure of external connectivity of autonomous systems and its change over time are given on examples. The largest telecommunication alliances are presented, which have an impact on the activities of telecom operators (directly or indirectly) and, as a result, on the set of resources and services (as well as their cost) received by end users provided by telecommunication operators.Scienti c novelty: the considered structure of the cyberspace management system made it possible to identify the main systems that control cyberspace and the key elements whose management will allow controlling a given segment of cyberspace.
Keywords: cyberspace, autonomous system, management, Internet registrars, traffic exchange point, telecommunication alliances, connectivity graph, ICANN.
References
1. Starodubcev Yu.I., Zakalkin P.V., Ivanov S.A. Texnosfernaya vojna kak osnovnoj sposob razresheniya konfliktov v usloviyax globalizacii // Voennaya my’sl’. 2020. № 10. S.16-21.
2. Zarudnickij V.B. Xarakter i soderzhanie voenny’x konfliktov v sovremenny’x usloviyax i obozrimoj perspektive // Voennaya my’sl’. 2021. № 1. S.34-44.
3. Tumar V.A., Levchuk N.N. Kiberprostranstvo kak sreda protivoborstva: voenny’j aspekt i Belorusskij opy’t normotvorchestva // Vestnik Akademii voenny’x nauk. 2020. № 3 (72). S.43-49.
4. Durnev R.A., Kryukov K.Yu., Deduchenko F.M. Preduprezhdenie texnogenny’x katastrof, provociruemy’x v xode voenny’x dejstvij // Voennaya my’sl’. 2019. № 10. S. 41-48.
5. Zhilenkov A.A., Cherny’j S.G. Sistema bezavarijnogo upravleniya kriticheski vazhny’mi ob”ektami v usloviyax kiberneticheskix atak // Voprosy’ kiberbezopasnosti. 2020. № 2 (36). S. 58-66. DOI:10.21681/2311-3456-2020-2-58-66.
6. Gushhina E.A., Makarenko G.I., Sergin M.Yu. Obespechenie informacionno-texnologicheskogo suvereniteta gosudarstva v usloviyax razvitiya cifrovoj e’konomiki // Pravo.by. 2018. № 6 (56). S. 59-63.
7. Romashkina N.P., Markov A.S., Stefanovich D.V. Mezhdunarodnaya bezopasnost’, strategicheskaya stabil’nost’ i informacionny’e texnologii: Monografiya / N.P. Romashkina, A.S. Markov, D.V. Stefanovich. – Moskva, 2020. Ser. Biblioteka Nacional’nogo issledovatel’skogo instituta mirovoj e’konomiki i mezhdunarodny’x otnoshenij imeni E.M. Primakova. – 98 s. il.
8. Romashkina N.P. Global’ny’e voenno-politicheskie problemy’ mezhdunarodnoj informacionnoj bezopasnosti: tendencii, ugrozy’, perspektivy’ // Voprosy’ kiberbezopasnosti. 2019. № 1(29). S. 2-8. DOI: 10.21681/2311-3456-2019-1-2-9.
9. Karcxiya A.A., Makarenko G.I., Sergin M.Yu. Sovremenny’e trendy’ kiberugroz i transformaciya ponyatiya kiberbezopasnosti v usloviyax cifrovizacii sistemy’ prava // Voprosy’ kiberbezopasnosti. 2019. № 3 (31). S. 18-23. DOI: 10.21681/2311-3456- 2019-3-18-23.
10. Dobrodeev A.Yu. Kiberbezopasnost’ v Rossijskoj Federacii. Modny’j termin ili prioritetnoe texnologicheskoe napravlenie obespecheniya nacional’noj i mezhdunarodnoj bezopasnosti XXI veka // Voprosy’ kiberbezopasnosti. 2021. № 4 (44). S. 61-72. DOI:10.21681/2311-3456-2021-4-61-72.
11. Starodubcev Yu.I., Zakalkin P.V., Ivanov S.A. Mnogovektorny’j konflikt v kiberprostranstve kak predposy’lka formirovaniya novogo vida Vooruzhenny’x Sil // Voennaya my’sl’. 2021. № 12. S.126-135.
12. Kotenko I.V., Kribel’ A.M., Lauta O.S., Saenko I.B. Analiz processa samopodobiya setevogo trafika kak podxod k obnaruzheniyu kiberatak na komp’yuterny’e seti // E’lektrosvyaz’. 2020. № 12. S.54-59. DOI:10.34832/ELSV.2020.13.12.008.
13. Saenko I.B., Lauta O.S., Karpov M.A., Kribel’ A.M. Model’ ugroz resursam ITKS kak klyuchevomu aktivu kriticheski vazhnogo ob”ekta infrastruktury’ // E’lektrosvyaz’. 2021. № 1. S.36-44. DOI:10.34832/ELSV.2021.14.1.004
14. Kondakov S.E., Rud’ I.S. Model’ processa provedeniya komp’yuterny’x atak s ispol’zovaniem special’ny’x informacionny’x vozdejstvij // Voprosy’ kiberbezopasnosti. 2021. № 5 (45). S. 12-20. DOI:10.21681/2311-3456-2021-5-12-20.
15. Grechishnikov E.V., Dobryshin M.M., Kochedykov S.S., Novoselcev V.I. Algorithmic model of functioning of the system to detect and counter cyber attacks on virtual private network // Journal of Physics: Conference Series. International Conference “Applied Mathematics, Computational Science and Mechanics: Current Problems”, AMCSM 2018. 2019. S. 012064.
16. Bochkov S.I., Makarenko G.I., Fedichev A.V. Ob okinavskoj xartii global’nogo informacionnogo obshhestva i zadachax razvitiya rossijskix sistem kommunikacii // Pravovaya informatika. 2018. № 1. S. 4-14. DOI: 10.21681/1994-1404-2018-1-04-14
17. Starodubtsev Y.I., Balenko E.G., Zakalkin P.V., Fedorov V.H. Change dynamics for forms and opportunities of centers of power under globalization // V sbornike: 2020 International Multi-Conference on Industrial Engineering and Modern Technologies, FarEastCon 2020. 2020. S. 9271172. DOI: 10.1109/FarEastCon50210.2020.9271172.
18. Starodubtsev Y.I., Vershennik E.V., Balenko E.G., Fedorov V.H. Cyberspace: terminology, properties, problems of operation // V sbornike: 2020 International Multi-Conference on Industrial Engineering and Modern Technologies, FarEastCon 2020. 2020. S. 9271282. DOI: 10.1109/FarEastCon50210.2020.9271282.
19. Starodubcev Yu.I., Zakalkin P.V., Ivanov S.A. Strukturno-funkcional’naya model’ kiberprostranstva // Voprosy’ kiberbezopasnosti. 2021. № 4 (44). S. 16-24. DOI:10.21681/2311-3456-2021-4-16-24.
20. Zakalkin P.V. Aspekty ispol’zovanija kiberprostranstva v interesah korporativnyh system upravlenija // Trudy nauchno-issledovatel’skogo instituta radio. 2021. № 4. S. 23-32.
21. Issledovanie struktury’ seti internet: modeli, instrumenty’, metodiki: monografiya / M.V. Ivanov. – Oryol: Akademiya FSO Rossii, 2018. – 108 s. il.
22. Ivanov M.V., Kalashnikov I.V., Nurullaev M.M. Issledovanie strukturny’x svojstv seti internet na osnove metagrafovy’x modelej // Trudy’ SPIIRAN. 2020. T.19. № 4. S. 880-900.
23. Ivanov M.V., Filimonov P.A. Model’ seti Internet na urovne avtonomny’x sistem v vide bezmasshtabnogo grafa // Telekommunikacii: Nauka i texnologiya. 2016. № 11. S. 22-26.
76-86
Moskvichev, A. D. USING MICROKERNEL VIRTUALIZATION MEANS TO ENSURE THE SECURITY OF SYSTEMS WITH  MICROSERVICE ARCHITECTURE / A. D. Moskvichev, M. V. Dolgachev // Cybersecurity issues. – 2022. – № 1(47). – С. 87-94. – DOI: 10.21681/2311-3456-2022-1-87-94.
Abstract
Purpose of the article: to increase fault tolerance, security level and simplify the process of updating systems using a micro service architecture using virtualization tools.Method: Using microkernel virtualization tools called Unikernel images. Unikernel are virtual machine images containing a single application. Each micro service of the system runs in the Unikernel image, the processes and services used are not contained in the image.The result: a de nition of Unikernel is given; a comparison is made with existing virtualization systems. The mechanisms that implement the Unikernel technology are listed. The de nitions of the library operating system and microkernel are given. The de nition of Unikernel is given as a technology that combines library operating systems and microkernels. The main advantages of using Unikernel are listed: ensuring the security of information systems and ease of updates. A developed software tool for testing Unikernel images for the possibility of penetrating an information system in the event of a vulnerability of the “remote execution of arbitrary code” type in the software tool. The image was tested. In conclusion, the assessment of the effectiveness of the use of Unikernel technology for building systems with a micro service architecture, in particular for building SIEM systems.
Keywords: Unikernel, virtualization, operating systems, cloud computing, security, vulnerability, SIEM.
References
1. Rak, I. P. Tekhnologii oblachnyh vychislenij : uchebnoe posobie : [16+] / I. P. Rak, A. V. Platyonkin, E. V. Sysoev ; Tambovskij gosudarstvennyj tekhnicheskij universitet. – Tambov : Tambovskij gosudarstvennyj tekhnicheskij universitet (TGTU), 2017. – 82 s. : il. – Rezhim dostupa: po podpiske. – URL: https://biblioclub.ru/index.php?page=book&id=499410 (data obrashcheniya: 16.11.2021). – Bibliogr.: s. 79. – ISBN 978-5-8265-1826-7. – Tekst : elektronnyj.
2. Sistemnyj administrator / izd. OOO «Sindikat 13» ; gl. red. G. Polozhevec. – Moskva : Sindikat 13, 2017. – № 5(174). – 100 s. : il. – Rezhim dostupa: po podpiske. – URL: https://biblioclub.ru/index.php?page=book&id=459117. – ISSN 1813-5579. – Tekst : elektronnyj.
3. Koller R., Williams D. Will serverless end the dominance of linux in the cloud? [Conference] // ACM/SIGOPS HotOS. - Whistler : [s.n.], 2017. DOI: 10.1145/3102980.3103008
4. Dan Williams, Ricardo Koller, Martin Lucina, Nikhil Prakash Unikernels as Processes [Conference] // Proceedings of the ACM Symposium on Cloud Computing: International Conference on Management of Data. - New York : ACM, 2018. - pp. 199-211. DOI: 10.1145/3267809.3267845
5. Bespalov, D. A. Operacionnye sistemy real’nogo vremeni i tekhnologii razrabotki krossplatformennogo programmnogo obespecheniya: uchebnoe posobie : [16+] / D. A. Bespalov, S. M. Gushanskij, N. M. Korobejnikova ; YUzhnyj federal’nyj universitet. – Rostov-na-Donu; Taganrog : YUzhnyj federal’nyj universitet, 2019. – CHast’ 2. – 169 s. : il. – Rezhim dostupa: po podpiske. – URL: https://biblioclub.ru/index.php?page=book&id=577699 (data obrashcheniya: 16.11.2021). – Bibliogr. v kn. – ISBN 978-5-9275-3368-8. – Tekst : elektronnyj.
6. Poulton Nigel Docker Deep Dive [Book]. - [s.l.] : Packt Publishing, 2020. – 249 p.
7. Kundan Ajit Pratap Intelligent Automation with VMware [Book]. - [s.l.] : Packt Publishing, 2019. – 344 p.
8. Dragoni N., Giallorenzo S., Lafuente A. L., Mazzara M., Montesi F., Mustafin R., Safina L Microservices: Yesterday, Today, and Tomorrow [Conference] // Springer International Publishing. - [s.l.] : Cham, 2017. - pp. 195–216.
9. Turulin, I. I. Virtual’nye mashiny, operacionnye sistemy i prilozheniya : uchebnoe posobie / I. I. Turulin, V. G. Galalu, A. V. Dagaev ; Taganrogskij institut im. A. P. CHekhova (filial) RGEU (RINH). – Taganrog : Taganrogskij institut imeni A. P. CHekhova, 2015. – 64 s. : il., graf. – Rezhim dostupa: po podpiske. – URL: https://biblioclub.ru/index.php?page=book&id=614532 (data obrashcheniya: 16.11.2021). – Bibliogr. v kn. – ISBN 978-5-87976-951-7. – Tekst : elektronnyj.
10. Basynya, E. A. Sistemnoe administrirovanie i informacionnaya bezopasnost’ : uchebnoe posobie : [16+] / E. A. Basynya. – Novosibirsk : Novosibirskij gosudarstvennyj tekhnicheskij universitet, 2018. – 79 s. : il. – Rezhim dostupa: po podpiske. – URL: https://biblioclub.
ru/index.php?page=book&id=575325 (data obrashcheniya: 16.11.2021). – Bibliogr. v kn. – ISBN 978-5-7782-3484-0. – Tekst : elektronnyj.
11. Watada Junzo, Roy Arunava, Kadikar Ruturaj, Pham Hoang, Xu Bing Emerging Trends, Techniques and Open Issues of Containerization: A Review [Conference] // IEEE Access.[s.n.], 2017. –vol. 7 pp. 152443 - 152472 DOI: 10.1109/ACCESS.2019.2945930
12. Bruno Xavier, Tiago Ferreto, Luis Jersak Time Provisioning Evaluation of KVM, Docker and Unikernels in a Cloud Platform [Conference] // 16th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGrid), 2016. DOI: 10.1109/CCGrid.2016.86
13. Kocher P., Horn J., Fogh A., , Genkin D., Gruss D., Haas W., Hamburg M., Lipp M., Mangard S., Prescher T., Schwarz M., Yarom Y. Spectre attacks: Exploiting speculative execution [Conference] // IEEE Security and Privacy. - San Francisco : [s.n.], 2019. DOI: 10.1109/SP.2019.00002
14. Li Y., Dolan-Gavitt B., Weber S., Cappos J. Lock-in-Pop: Securing privileged operating system kernels by keeping on the beaten path [Conference] // USENIX Annual Technical Conf. - Santa Clara : [s.n.], 2017. pp. 1-13
15. Odun-Ayo Isaac, Geteloma Victor, Eweoya Ibukun, Ahuja Ravin Virtualization, Containerization, Composition, and Orchestration of Cloud Computing Services [Conference]. - California : Computational Science and Its Applications – ICCSA, 2019. pp. 403–417 DOI: 10.1007/978-3-030-24305-0_30
16. Batcher M. Go na praktike / Mett Batcher, Mett Farina ; per. s angl. R. N. Ragimova; nauch. red. A. N. Kiselev. – M.: DMK Press, 2017. – 374 s.
17. Biryukov, A. A. Informacionnaya bezopasnost’: zashchita i napadenie [Tekst] / A. A. Biryukov. – 2-e izd., pererab. i dop. – M. : DMK Press, 2017. – 434 s. : il. – ISBN 978-5-97060-435-9.
18. Michael Kurth, Ben Gras, Dennis Andriesse, Cristiano Giuffrida, Herbert Bos, Kaveh Razavi NetCAT: Practical cache attacks from the network [Conference] // IEEE Symposium on Security and Privacy (SP). - San Francisco : Institute of Electrical and Electronics Engineers Inc., 2020. pp. 20-38 DOI: 10.1109/SP40000.2020.00082
19. Kai-Oliver Detken, Marcel Jahnke, Carsten Kleiner, Marius Rohde, Combining Network Access Control (NAC) and SIEM functionality based on open source [Conference]. - Bucharest, Romania : 9th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 2017. DOI: 10.1109/IDAACS.2017.8095094
20. Jain V., Qi S.,Ramakrishnan K.K. Fast Function Instantiation with Alternate Virtualization Approaches [Conference]. - California : IEEE Computer Society, 2021. - Vols. 2021-July. DOI: 10.1109/LANMAN52105.2021.9478808
87-94
Kalashnikov, A. O. MANAGEMENT OF RISKS FOR COMPLEX NETWORK BASED ON AN ARBITRATION MODEL / A. O. Kalashnikov, E. V. Anikina // Cybersecurity issues. – 2022. – № 1(47). – С. 95-101. – DOI: 10.21681/2311-3456-2022-1-95-101.
Abstract
Purpose of the article: to increase fault tolerance, security level and simplify the process of updating systems using a micro service architecture using virtualization tools.Method: Using microkernel virtualization tools called Unikernel images. Unikernel are virtual machine images containing a single application. Each micro service of the system runs in the Unikernel image, the processes and services used are not contained in the image.The result: a de nition of Unikernel is given; a comparison is made with existing virtualization systems. The mechanisms that implement the Unikernel technology are listed. The de nitions of the library operating system and microkernel are given. The de nition of Unikernel is given as a technology that combines library operating systems and microkernels. The main advantages of using Unikernel are listed: ensuring the security of information systems and ease of updates. A developed software tool for testing Unikernel images for the possibility of penetrating an information system in the event of a vulnerability of the “remote execution of arbitrary code” type in the software tool. The image was tested. In conclusion, the assessment of the effectiveness of the use of Unikernel technology for building systems with a micro service architecture, in particular for building SIEM systems.
Keywords: Unikernel, virtualization, operating systems, cloud computing, security, vulnerability, SIEM.
References
1. Kalashnikov, A.O. Modeli i metody’ organizacionnogo upravleniya informacionny’mi riskami korporacij // A.O. Kalashnikov – M.: E’gves, 2011. – 312 s. – ISBN 978-5-91450-078-5.
2. Kalashnikov, A.O. Organizacionny’e mexanizmy’ upravleniya informacionny’mi riskami korporacij // A.O. Kalashnikov – M.: PMSOFT, 2008. – 175 s. – ISBN 978-5-9900281-9-7.
3. Modeli upravleniya informacionny’mi riskami slozhny’x sistem / A.O. Kalashnikov, E.V. Anikina // Informaciya i bezopasnost’. – 2020. – Tom 23. – № 2(4). – S. 191-202.
4. Management of Risks for Complex Computer Network / A.O. Kalashnikov, E.V. Anikina // Proceedings of the 23rd International Conference on Distributed Computer and Communication Networks: Control, Computation, Communications (DCCN-2020, Moscow). – Cham: Springer, 2020. – vol 1337. – S. 144-157.
5. Upravlenie informacionny’mi riskami slozhnoj sistemy’ s ispol’zovaniem mexanizma “kognitivnoj igry’” / A.O. Kalashnikov, E.V. Anikina // Voprosy’ kiberbezopasnosti – 2020. – № 4(38). – S. 2-10.
6. Upravlenie informacionny’mi riskami s ispol’zovaniem arbitrazhny’x sxem / A.O. Kalashnikov // Sistemy’ upravleniya i informacionny’e texnologii. – 2004. – № 4 (16). – S. 57-61.
7. Arbitrazhnaya model’ upravleniya informacionny’mi riskami organizacionny’x sistem / A.O. Kalashnikov // Sistemy’ upravleniya i informacionny’e texnologii. – 2006. – № 3 (25). – S. 41-45.
8. «Maksimal’no stimuliruyushhee» reshenie v zadache upravleniya informacionny’mi riskami organizacionny’x sistem / A.O. Kalashnikov // Sistemy’ upravleniya i informacionny’e texnologii. – 2006. – № 3(25). – S. 45-51.
9. Analiz chastny’x sluchaev «maksimal’no stimuliruyushhego» resheniya v zadache upravleniya informacionny’mi riskami organizacionny’x sistem / A.O. Kalashnikov // Sistemy’ upravleniya i informacionny’e texnologii. – 2006. – № 4(26). – S. 53-59.
10. O principe stimulyacii v arbitrazhnoj sxeme / V.I. Rotar’ // E’konomika i matematicheskie metody’ – 1984. – t. XVII. v. 4. – S. 751-764.
11. Ob odnom klasse predpochtenij v prostranstve raspredelenij (uchet rosta i razbrosa) / A.O. Kalashnikov, V.I. Rotar’ // Modeli i metody’ stoxasticheskoj optimizacii. – M.: CE’MI. – 1983. – S. 77-89.
95-101

Be the first to comment

Leave a Reply

Your email address will not be published.


*


This site uses Akismet to reduce spam. Learn how your comment data is processed.