Automation of Information Security Risk Assessment

• Autorzy: Akhmetov Berik , Lakhno Valerii , Chubaievskyi Vitalyi , Kaminskyi Serhii , Adilzhanova Saltanat , Ydyryshbayeva Moldir

Identyfikatory

DOI

10.24425/ijet.2022.141273

• Języki publikacji: EN

Abstrakty

EN

An information security audit method (ISA) for a distributed computer network (DCN) of an informatization object (OBI) has been developed. Proposed method is based on the ISA procedures automation by using Bayesian networks (BN) and artificial neural networks (ANN) to assess the risks. It was shown that such a combination of BN and ANN makes it possible to quickly determine the actual risks for OBI information security (IS). At the same time, data from sensors of various hardware and software information security means (ISM) in the OBI DCS segments are used as the initial information. It was shown that the automation of ISA procedures based on the use of BN and ANN allows the DCN IS administrator to respond dynamically to threats in a real time manner, to promptly select effective countermeasures to protect the DCS.

Słowa kluczowe

EN

information security; audit; Bayesian network; artificial neural networks

• Wydawca: Polish Academy of Sciences, Committee of Electronics and Telecommunication
• Czasopismo: International Journal of Electronics and Telecommunications
• Rocznik: 2022
• Tom: Vol. 68. No. 3
• Strony: 549--555
• Opis fizyczny: Bibliogr. 38 poz., schem., tab., wykr.

Twórcy

autor

Akhmetov Berik

• Yessenov University, Aktau, Kazakhstan

autor

Lakhno Valerii

• National University of Life and Environmental Sciences of Ukraine, Kyiv, Ukraine

autor

Chubaievskyi Vitalyi

• Kyiv National University of Trade and Economics, Kyiv, Ukraine

autor

Kaminskyi Serhii

• Kyiv National University of Trade and Economics, Kyiv, Ukraine

autor

Adilzhanova Saltanat

• Al-Farabi Kazakh National University, Almaty, Kazakhstan

autor

Ydyryshbayeva Moldir

• Al-Farabi Kazakh National University, Almaty, Kazakhstan

Bibliografia

• [1] R. Langner, "Stuxnet: Dissecting a Cyberwarfare Weapon," in IEEE Security & Privacy, vol. 9, no. 3, pp. 49-51, May-June 2011, https://doi.org/10.1109/MSP.2011.67
• [2] Lyubchenko, A. A. (2019). The Information Society and the Threat of Cyberwar. In Derzhavin Readings (pp. 303-305).
• [3] Humphreys, E. (2008). Information security management standards: Compliance, governance and risk management. information security technical report, 13(4), 247-255. https://doi.org/10.1016/j.istr.2008.10.010
• [4] Kanatov, M., Atymtayeva, L., & Yagaliyeva, B. (2014, December). Expert systems for information security management and audit. Implementation phase issues. In 2014 Joint 7th International Conference on Soft Computing and Intelligent Systems (SCIS) and 15th International Symposium on Advanced Intelligent Systems (ISIS) (pp. 896-900). IEEE. https://doi.org/10.1109/SCIS-ISIS.2014.7044702
• [5] Han, D., Dai, Y., Han, T., & Dai, X. (2015). Explore Awareness of Information Security: Insights from Cognitive Neuromechanism. Computational Intelligence and Neuroscience, 2015, 762403-762403. https://doi.org/10.1155/2015/762403
• [6] Andrade, R., Torres, J., & Flores, P. (2018, January). Management of information security indicators under a cognitive security model. In 2018 IEEE 8th annual computing and communication workshop and conference (CCWC) (pp. 478-483). IEEE. https://doi.org/10.1109/CCWC.2018.8301745
• [7] Grediaga, Á., Ibarra, F., García, F., Ledesma, B., & Brotóns, F. (2006, May). Application of neural networks in network control and information security. In International Symposium on Neural Networks (pp. 208-213). Springer, Berlin, Heidelberg. https://doi.org/10.1007/11760191_31
• [8] Mukkamala, S., Janoski, G., & Sung, A. (2002, May). Intrusion detection using neural networks and support vector machines. In Proceedings of the 2002 International Joint Conference on Neural Networks. IJCNN'02 (Cat. No. 02CH37290) (Vol. 2, pp. 1702-1707). IEEE. https://doi.org/10.1109/IJCNN.2002.1007774
• [9] Kirta, T., & Kivimaab, J. (2010). Optimizing it security costs by evolutionary algorithms. In Conference on Cyber Conflict Proceedings (pp. 145-160). https://ccdcoe.org/uploads/2018/10/Kirt-et-al-Optimizing-IT-security-costs-by-evolutionary-algorithms.pdf
• [10] S. Lysenko, K. Bobrovnikova, R. Shchuka and O. Savenko, "A Cyberattacks Detection Technique Based on Evolutionary Algorithms," 2020 IEEE 11th International Conference on Dependable Systems, Services and Technologies (DESSERT), 2020, pp. 127-132, https://doi.org/10.1109/DESSERT50317.2020.9125016
• [11] Barankova I.I., Mikhailova U.V., Kalugina O.B. (2020) Analysis of the Problems of Industrial Enterprises Information Security Audit. In: Radionov A., Karandaev A. (eds) Advances in Automation. RusAutoCon 2019. Lecture Notes in Electrical Engineering, vol 641. Springer, Cham. https://doi.org/10.1007/978-3-030-39225-3_104
• [12] Steinbart, P. J., Raschke, R. L., Gal, G., & Dilla, W. N. (2018). The influence of a good relationship between the internal audit and information security functions on information security outcomes. Accounting, Organizations and Society, 71, 15-29. https://doi.org/10.1016/j.aos.2018.04.005
• [13] Mataracioglu, T., & Ozkan, S. (2011). Governing information security in conjunction with COBIT and ISO 27001. arXiv preprint arXiv:1108.2150.
• [14] Steinbart, P. J., Raschke, R. L., Gal, G., & Dilla, W. N. (2012). The relationship between internal audit and information security: An exploratory investigation. International Journal of Accounting Information Systems, 13(3), 228-243. https://doi.org/10.1016/j.accinf.2012.06.007
• [15] R. Montesino and S. Fenz, "Information Security Automation: How Far Can We Go?," 2011 Sixth International Conference on Availability, Reliability and Security, 2011, pp. 280-285, https://doi.org/10.1109/ARES.2011.48.
• [16] Au, C. H., & Fung, W. S. (2019). Integrating Knowledge Management into Information Security: From Audit to Practice. International Journal of Knowledge Management (IJKM), 15(1), 37-52. https://doi.org/10.4018/IJKM.2019010103
• [17] Stafford, T., Deitz, G., & Li, Y. (2018). The role of internal audit and user training in information security policy compliance. Managerial Auditing Journal, 33(4), 410-424. https://doi.org/10.1108/MAJ-07-2017-1596
• [18] T. S. M. Pereira and H. Santos, "A Security Framework for Audit and Manage Information System Security," 2010 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, 2010, pp. 29-32, https://doi.org/10.1109/WI-IAT.2010.244
• [19] Mashkina I. V., Sentsova A. U. The methodology of expert audit in the cloud computing system // Information technology security, 2013. № 4. P. 63–70.
• [20] Guzairov M. B., Mashkina, I. V., Stepanova E. S. The treats model development by fuzzy cognitive maps formation on the bases of security policy // Information technology security, 2011. № 2. P. 37–49.
• [21] Sentsova, A. Yu., Mashkina, I. V. Automation of an expert audit of information security based on the use of an artificial neural network. Information technology security. National Research Nuclear University "MEPhI" VNIIPVTI, No 2, 2014. p. 118-126.
• [22] Makarevich, O., Mashkina, I., & Sentsova, A. (2013, November). The method of the information security risk assessment in cloud computing systems. In Proceedings of the 6th International Conference on Security of Information and Networks (pp. 446-447).
• [23] Mashkina, I. V., & Sentsova, A. U. (2014). The Method of the Information Security Risk Assessment in Cloud Computing Systems. In Computer Science and Information Technologies (CSIT'2014). (pp. 86-91).
• [24] Akhmetov, B., Lakhno, V., Akhmetov, B., & Alimseitova, Z. (2018, September). Development of sectoral intellectualized expert systems and decision making support systems in cybersecurity. In Proceedings of the Computational Methods in Systems and Software (pp. 162-171). Springer, Cham.
• [25] Lois, P., Drogalas, G., Karagiorgos, A., Thrassou, A., & Vrontis, D. (2021). Internal auditing and cyber security: audit role and procedural contribution. International Journal of Managerial and Financial Accounting, 13(1), 25-47.
• [26] Roldán-Molina, G., Almache-Cueva, M., Silva-Rabadão, C., Yevseyeva, I., & Basto-Fernandes, V. (2017, June). A decision support system for corporations cybersecurity management. In 2017 12th Iberian Conference on Information Systems and Technologies (CISTI) (pp. 1-6). IEEE. https://doi.org/10.23919/CISTI.2017.7975826
• [27] Calderon, T. G., & Cheh, J. J. (2002). A roadmap for future neural networks research in auditing and risk assessment. International Journal of Accounting Information Systems, 3(4), 203-236. https://doi.org/10.1016/S1467-0895(02)00068-4
• [28] Gaganis, C., Pasiouras, F., & Doumpos, M. (2007). Probabilistic neural networks for the identification of qualified audit opinions. Expert Systems with Applications, 32(1), 114-124. https://doi.org/10.1016/j.eswa.2005.11.003
• [29] Atamanov, A. N. (2012). Methodology for dynamic iterative assessment of information security risks in automated systems. Global Science Potential, (3), 30-34.
• [30] Markowski, A. S., & Mannan, M. S. (2009). Fuzzy logic for piping risk assessment (pfLOPA). Journal of loss prevention in the process industries, 22(6), 921-927. https://doi.org/10.1016/j.jlp.2009.06.011
• [31] Grace, A. M., & Williams, S. O. (2016). Comparative analysis of neural network and fuzzy logic techniques in credit risk evaluation. International Journal of Intelligent Information Technologies (IJIIT), 12(1), 47-62. https://doi.org/10.4018/IJIIT.2016010103
• [32] Mokhor, V., & Honchar, S. F. (2018). The Idea of the Construction of the Algebra of Risks on the Basis of the Theory of Complex Numbers. Electronic modeling, 40(4), 107-111. https://doi.org/10.15407/emodel.40.04.107
• [33] Mokhor, V., Honchar, S., & Onyskova, A. (2020). Cybersecurity Risk Assessment of Information Systems of Critical Infrastructure Objects. In 2020 IEEE International Conference on Problems of Infocommunications. Science and Technology (PIC S&T). (pp. 19-22). IEEE. https://doi.org/10.1109/PICST51311.2020.9467957
• [34] Akhmetov, B. S., Lakhno, V. A., Ydyryshbayeva, M. B., Yagaliyeva, B. E., Baiganova, A. V., Akhanova, M. B., Tashimova, A. K. Application of bayesian networks in the decision support system during the analysis of cyber threats (2021) Journal of Theoretical and Applied Information Technology, 99 (4), pp. 884-893.
• [35] US National Vulnerability Database - https://nvd.nist.gov/
• [36] Bebeshko, B., Khorolska, K., Kotenko, N., Kharchenko, O., & Zhyrova, T. (2021). Use of neural networks for predicting cyberattacks. Paper presented at the CEUR Workshop Proceedings, 2923 13-223. http://ceurws.org/Vol-2923/paper23.pdf
• [37] Khorolska K., Lazorenko V., Bebeshko B., Desiatko A., Kharchenko O., Yaremych V. (2022) Usage of Clustering in Decision Support System. In: Raj J. S., Palanisamy R., Perikos I., Shi Y. (eds) Intelligent Sustainable Systems. Lecture Notes in Networks and Systems, vol 213. Springer, Singapore. https://doi.org/10.1007/978-981-16-2422-3_49
• [38] Lakhno V., Akhmetov B., Ydyryshbayeva M., Bebeshko B., Desiatko A., Khorolska K. (2021) Models for Forming Knowledge Databases for Decision Support Systems for Recognizing Cyberattacks. In: Vasant P., Zelinka I., Weber GW. (eds) Intelligent Computing and Optimization. ICO 2020. Advances in Intelligent Systems and Computing, vol 1324. Springer, Cham. https://doi.org/10.1007/978-3-030-68154-8_42

Uwagi

Opracowanie rekordu ze środków MEiN, umowa nr SONP/SP/546092/2022 w ramach programu "Społeczna odpowiedzialność nauki" - moduł: Popularyzacja nauki i promocja sportu (2022-2023).