maisМоделирование и анализ информационных системModeling and Analysis of Information Systems1818-10152313-5417Yaroslavl State University10.18255/1818-1015-2020-1-108-123mais-1292Research ArticleDiscrete Mathematics in Relation to Computer ScienceМарковская модель совместных киберугроз и ее применение для выбора оптимального набора средств защиты информацииA Markov Model of Non-Mutually Exclusive Cyber Threats and its Applications for Selecting an Optimal Set of Information Security Remedieshttps://orcid.org/0000-0002-2770-1144КасеновАдиль АскаровичKassenovAdil A.

магистрант

graduate student

kassenov_adil@mail.ruhttps://orcid.org/0000-0002-8725-9183МагазевАлексей АнатольевичMagazevAlexey A.

доктор физ.-мат. наук, профессор

doctor of sc., professor

magazev@omgtu.ruhttps://orcid.org/0000-0002-6875-7216ЦырульникВалерия ФедоровнаTsyrulnikValeriya F.

аспирантка

postgraduate student

lera.tsyrulnik@mail.ruОмский государственный технический университетРоссияOmsk State Technical UniversityRussian Federation202019032020271108123Copyright © Касенов А.А., Магазев А.А., Цырульник В.Ф., 20202020Касенов А.А., Магазев А.А., Цырульник В.Ф.Kassenov A.A., Magazev A.A., Tsyrulnik V.F.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://www.mais-journal.ru/jour/article/view/1292

В данной работе исследуется марковская модель киберугроз, действующих на компьютерную систему. В рамках данной модели компьютерная система рассматривается как система с отказами и восстанавлениями по аналогии с моделями теории надежности. Для оценки функционально-временных свойств системы мы вводим ее параметр, называемый временем жизни и определяемый как число переходов в соответствующей марковской цепи до первого попадания в финальное состояние. В силу того, что данная случайная величина играет важную роль при оценке уровня защищенности компьютерной системы, мы подробно исследуем ее распределение вероятностей в случае несовместных киберугроз; в частности, мы получаем явные аналитические формулы для ее числовых характеристик: математического ожидания и дисперсии. Затем мы существенно обобщаем рассматриваемую марковскую модель, исключив допущение о несовместности действующих на систему киберугроз. Соответствующая марковская цепь при такой модификации расширяется за счет дополнительных состояний, не меняя своей качественной структуры. Указанный факт позволил обобщить полученные ранее аналитические результаты для математического ожидания и дисперсии времени жизни на случай совместных киберугроз. В заключении работы марковская модель совместных кибеугроз используется для постановки задачи о поиске оптимальной конфигурации средств защиты информации в заданном пространстве киберугроз. Существенно, что сформулированные оптимизационные задачи принадлежат к классу задач нелинейного дискретного (булева) программирования. В заключении работы рассматривается пример, иллюстрирующий решение задачи о выборе оптимального набора средств защиты для компьютерной системы.

In this work, we study a Markov model of cyber threats that act on a computer system. Within the framework of the model the computer system is considered as a system with failures and recoveries by analogy with models of reliability theory. To estimate functionally-temporal properties of the system we introduce a parameter called the lifetime of the system and defined as the number of transitions of the corresponding Markov chain until the first hit to the final state. Since this random variable plays an important role at evaluating a security level of the computer system, we investigate in detail its random distribution for the case of mutually exclusive cyber threats; in particular, we derive explicit analytical formulae for numerical characteristics of its distribution: expected value and dispersion. Then we generalize substantially the Markov model dropping the assumption that cyber threats acting on the system are mutually exclusive. This modification leads to an extended Markov chain that has (at least qualitatively) the same structure as the original chain. This fact allowed to generalize the above analytical results for the expected value and dispersion of the lifetime to the case of non-mutually exclusive cyber threats. At the end of the work the Markov model for non-mutually exclusive cyber threats is used to state a problem of finding an optimal configuration of security remedies in a given cyber threat space. It is essential that the formulated optimization problems belong to the class of non-linear discrete (Boolean) programming problems. Finally, we consider an example that illustrate the solution of the problem on selecting the optimal set of security remedies for a computer system.

киберугрозамарковская цепьсредство защиты информацииоптимизацияcyber threatMarkov chainsecurity remedyoptimizationИсследование выполнено при финансовой поддержке РФФИ в рамках научного проекта № 19-37-90122.The reported study was funded by RFBR, project number 19-37-90122.ReferencesN. Ye, Y. Zhang, and B. C.M., “Robustness of the Markov-chain model for cyber-attack detection”, IEEE Transactions on Reliability, vol. 53, no. 1, pp. 116–123, 2004.N. Ye, Y. Zhang, and B. C.M., “Robustness of the Markov-chain model for cyber-attack detection”, IEEE Transactions on Reliability, vol. 53, no. 1, pp. 116–123, 2004.S. Jha, K. Tan, and R. Maxion, “Markov Chains, Classifiers, and Intrusion Detection.”, in Proc. IEEE Computer Security Foundations Workshops, vol. 1, 2001, pp. 206–219.S. Jha, K. Tan, and R. Maxion, “Markov Chains, Classifiers, and Intrusion Detection.”, in Proc. IEEE Computer Security Foundations Workshops, vol. 1, 2001, pp. 206–219.A. Ahmadian Ramaki, A. Rasoolzadegan, and A. Javan Jafari, “A systematic review on intrusion detection based on the Hidden Markov Model”, Statistical Analysis and Data Mining: The ASA Data Science Journal, vol. 11, no. 3, pp. 111–134, 2018.A. Ahmadian Ramaki, A. Rasoolzadegan, and A. Javan Jafari, “A systematic review on intrusion detection based on the Hidden Markov Model”, Statistical Analysis and Data Mining: The ASA Data Science Journal, vol. 11, no. 3, pp. 111–134, 2018.P. Garcia-Teodoro, J. Diaz-Verdejo, G. Macia-Fern ´ andez, and E. V ´ azquez, “Anomaly-based network ´ intrusion detection: Techniques, systems and challenges”, Computers and Security, vol. 28, no. 1-2, pp. 18–28, 2009.P. Garcia-Teodoro, J. Diaz-Verdejo, G. Macia-Fern ´ andez, and E. V ´ azquez, “Anomaly-based network ´ intrusion detection: Techniques, systems and challenges”, Computers and Security, vol. 28, no. 1-2, pp. 18–28, 2009.L. Billings, W. Spears, and I. Schwartz, “A unified prediction of computer virus spread in connected networks”, Physics Letters A, vol. 297, no. 3-4, pp. 261–266, 2002.L. Billings, W. Spears, and I. Schwartz, “A unified prediction of computer virus spread in connected networks”, Physics Letters A, vol. 297, no. 3-4, pp. 261–266, 2002.A. Boyko, “Sposob analiticheskogo modelirovaniya protsessa rasprostraneniya virusov v komp’yuternykh setyakh razlichnoy struktury”, Trudy SPIIRAN, vol. 5, no. 42, pp. 196–211, 2015.A. Boyko, “Sposob analiticheskogo modelirovaniya protsessa rasprostraneniya virusov v komp’yuternykh setyakh razlichnoy struktury”, Trudy SPIIRAN, vol. 5, no. 42, pp. 196–211, 2015.Y. Dalinger, D. Babanin, and B. S.M., “Matematicheskie modeli rasprostraneniya virusov v komp’yuternykh setyakh razlichnoy struktury”, Informatika i sistemy upravleniya, no. 4, pp. 25–33, 2012.Y. Dalinger, D. Babanin, and B. S.M., “Matematicheskie modeli rasprostraneniya virusov v komp’yuternykh setyakh razlichnoy struktury”, Informatika i sistemy upravleniya, no. 4, pp. 25–33, 2012.A. Del Rey, “Mathematical modeling of the propagation of malware: a review”, Security and Communication Networks, vol. 8, no. 15, pp. 2561–2579, 2015.A. Del Rey, “Mathematical modeling of the propagation of malware: a review”, Security and Communication Networks, vol. 8, no. 15, pp. 2561–2579, 2015.M. Yang, R. Jiang, T. Gao, W. Xie, and J. Wang, “Research on Cloud Computing Security Risk Assessment Based on Information Entropy and Markov Chain.”, I. J. Network Security, vol. 20, no. 4, p. 664–673, 2018.M. Yang, R. Jiang, T. Gao, W. Xie, and J. Wang, “Research on Cloud Computing Security Risk Assessment Based on Information Entropy and Markov Chain.”, I. J. Network Security, vol. 20, no. 4, p. 664–673, 2018.C. Xiaolin, T. Xiaobin, Z. Yong, and X. Hongsheng, “A Markov game theory-based risk assessment model for network information system”, in International Conference on Computer Science and Software Engineering, China, IEEE, vol. 3, 2008, pp. 1057–1061.C. Xiaolin, T. Xiaobin, Z. Yong, and X. Hongsheng, “A Markov game theory-based risk assessment model for network information system”, in International Conference on Computer Science and Software Engineering, China, IEEE, vol. 3, 2008, pp. 1057–1061.H. Orojloo and M. Azgomi, “A method for modeling and evaluation of the security of cyber-physical systems”, in 11th International ISC Conference on Information Security and Cryptology, Iran, IEEE, 2014, pp. 131–136.H. Orojloo and M. Azgomi, “A method for modeling and evaluation of the security of cyber-physical systems”, in 11th International ISC Conference on Information Security and Cryptology, Iran, IEEE, 2014, pp. 131–136.J. Almasizadeh and M. Azgomi, “A stochastic model of attack process for the evaluation of security metrics”, Computer Networks, vol. 57, no. 10, pp. 2159–2180, 2013.J. Almasizadeh and M. Azgomi, “A stochastic model of attack process for the evaluation of security metrics”, Computer Networks, vol. 57, no. 10, pp. 2159–2180, 2013.K. Shcheglov and A. Shcheglov, “Markovskie modeli ugrozy bezopasnosti informatsionnoy sistemy”, Izvestiya vysshikh uchebnykh zavedeniy. Priborostroenie, vol. 58, no. 12, pp. 957–965, 2015.K. Shcheglov and A. Shcheglov, “Markovskie modeli ugrozy bezopasnosti informatsionnoy sistemy”, Izvestiya vysshikh uchebnykh zavedeniy. Priborostroenie, vol. 58, no. 12, pp. 957–965, 2015.A. Rosenko, “Matematicheskoe modelirovanie vliyaniya vnutrennikh ugroz na bezopasnost’ konfidentsial’noy informatsii, tsirkuliruyushchey v avtomatizirovannoy informatsionnoy sisteme”, Izvestiya Yuzhnogo federal’nogo universiteta. Tekhnicheskie nauki, vol. 85, no. 8, pp. 71–81, 2008.A. Rosenko, “Matematicheskoe modelirovanie vliyaniya vnutrennikh ugroz na bezopasnost’ konfidentsial’noy informatsii, tsirkuliruyushchey v avtomatizirovannoy informatsionnoy sisteme”, Izvestiya Yuzhnogo federal’nogo universiteta. Tekhnicheskie nauki, vol. 85, no. 8, pp. 71–81, 2008.A. Magazev and V. Tsyrulnik, “Investigation of a Markov Model for Computer System Security ‘reats”, Automatic Control and Computer Sciences, vol. 52, no. 7, pp. 615–624, 2018.A. Magazev and V. Tsyrulnik, “Investigation of a Markov Model for Computer System Security ‘reats”, Automatic Control and Computer Sciences, vol. 52, no. 7, pp. 615–624, 2018.A. Magazev and V. Tsyrulnik, “Optimizing the selection of information security remedies in terms of a Markov security model”, in Journal of Physics: Conference Series, vol. 1096, 2018, p. 012 160.A. Magazev and V. Tsyrulnik, “Optimizing the selection of information security remedies in terms of a Markov security model”, in Journal of Physics: Conference Series, vol. 1096, 2018, p. 012 160.D. Shirtz and Y. Elovici, “Optimizing investment decisions in selecting information security remedies”, Information Management and Computer Security, vol. 19, no. 2, pp. 95–112, 2011.D. Shirtz and Y. Elovici, “Optimizing investment decisions in selecting information security remedies”, Information Management and Computer Security, vol. 19, no. 2, pp. 95–112, 2011.P. A.P., Y. Brychkov, and M. O.I., Integrals and series: Elementary functions. Gordon&Breach Sci. Publ., New York, 1986, vol. 1.P. A.P., Y. Brychkov, and M. O.I., Integrals and series: Elementary functions. Gordon&Breach Sci. Publ., New York, 1986, vol. 1.W. Feller, An introduction to probability theory and its applications. John Wiley & Sons Inc, 1968, vol. 1, 528 pp.W. Feller, An introduction to probability theory and its applications. John Wiley & Sons Inc, 1968, vol. 1, 528 pp.A. e. a. Ovchinnikov, “Matematicheskaya model’ optimal’nogo vybora sredstv zashchity ot ugroz bezopasnosti vychislitel’noy seti predpriyatiya”, Vestnik Moskovskogo gosudarstvennogo tekhnicheskogo universiteta im. N. E. Baumana. Ser. “Priborostroenie”, no. 3, pp. 115–121, 2007.A. e. a. Ovchinnikov, “Matematicheskaya model’ optimal’nogo vybora sredstv zashchity ot ugroz bezopasnosti vychislitel’noy seti predpriyatiya”, Vestnik Moskovskogo gosudarstvennogo tekhnicheskogo universiteta im. N. E. Baumana. Ser. “Priborostroenie”, no. 3, pp. 115–121, 2007.M. Kovalev, Diskretnaya optimizatsiya (tselochislennoe programmirovanie), 2-e izd., stereotipnoe. Editorial URSS, 2003, 192 pp.M. Kovalev, Diskretnaya optimizatsiya (tselochislennoe programmirovanie), 2-e izd., stereotipnoe. Editorial URSS, 2003, 192 pp.Beshelev, S.D., and F. Gurvich, Matematiko-statisticheskie metody ekspertnykh otsenok. 1980, 263 pp.Beshelev, S.D., and F. Gurvich, Matematiko-statisticheskie metody ekspertnykh otsenok. 1980, 263 pp.

The authors declare that there are no conflicts of interest present.