Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2019-3-39-44
M. M. Rovnyagin, Pao Sberbank, I. Chugunkov, N. Savchenko
{"title":"Hybrid Containerized Computing Technology for High-Performance Data Processing in Cluster Systems","authors":"M. M. Rovnyagin, Pao Sberbank, I. Chugunkov, N. Savchenko","doi":"10.21681/2311-3456-2019-3-39-44","DOIUrl":"https://doi.org/10.21681/2311-3456-2019-3-39-44","url":null,"abstract":"","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"44 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126047367","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2023-2-73-84
Igor Kotenko, I. Saenko, R. Zakharchenko, A.A. Kapustin, Mazen Al-Barri
The purpose of the article: analysis of the problem of ensuring timely authorized access to the resources of the electronic information and educational environment of universities of federal executive authorities and identification of possible directions for its solution. Research methods: system analysis of the problem of ensuring access of officials of universities of federal executive authorities to the resources of the electronic information and educational environment. The result obtained: approaches to improving the existing access control model, optimizing the role-based access scheme and determining unauthorized access attempts based on machine learning methods are proposed. Scope of the proposed approach: access control system of the electronic information and educational environment of universities of federal executive authorities. Scientific novelty: consists in a comprehensive analysis of the problem of creating and functioning of the electronic information and educational environment of universities of federal executive authorities, during which the structure of this environment is determined and its characteristic features are highlighted. Based on the analysis of information security threats in the electronic information and educational environment, the necessity of creating an access control system to its resources, which provides timely authorized access, is substantiated. The proposed approaches to improving the access control system affect not only the improvement of the existing access model by supplementing it with solutions available in the attribute-based access model, but also the optimization of the role- based access scheme using the developed genetic algorithm and the detection of unauthorized access attempts associated with overcoming access rules, based on application of machine learning methods. Experimental results are presented that confirm the effectiveness of the proposed approaches. Contribution: Igor Kotenko – analysis of the state of the art in the creation and application of the electronic information and educational environment of universities of federal executive authorities, setting the task and developing proposals for developing the functionality of the access control system, development of approaches to genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Igor Saenko – development of approaches to improving the access control system related to the use of an attribute-based access model, genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Roman Zakharchenko – analysis of technical solutions that ensure the implementation of the access control system to the resources of the electronic information and educational environment of universities of federal executive authorities, Alexander Kapustin – analysis of security threats and access control models to resources of the elect
{"title":"MANAGEMENT OF ACCESS TO ELECTRONIC INFORMATION AND EDUCATIONAL ENVIRONMENT OF UNIVERSITIES OF FEDERAL EXECUTIVE AUTHORITIES","authors":"Igor Kotenko, I. Saenko, R. Zakharchenko, A.A. Kapustin, Mazen Al-Barri","doi":"10.21681/2311-3456-2023-2-73-84","DOIUrl":"https://doi.org/10.21681/2311-3456-2023-2-73-84","url":null,"abstract":"The purpose of the article: analysis of the problem of ensuring timely authorized access to the resources of the electronic information and educational environment of universities of federal executive authorities and identification of possible directions for its solution. Research methods: system analysis of the problem of ensuring access of officials of universities of federal executive authorities to the resources of the electronic information and educational environment. The result obtained: approaches to improving the existing access control model, optimizing the role-based access scheme and determining unauthorized access attempts based on machine learning methods are proposed. Scope of the proposed approach: access control system of the electronic information and educational environment of universities of federal executive authorities. Scientific novelty: consists in a comprehensive analysis of the problem of creating and functioning of the electronic information and educational environment of universities of federal executive authorities, during which the structure of this environment is determined and its characteristic features are highlighted. Based on the analysis of information security threats in the electronic information and educational environment, the necessity of creating an access control system to its resources, which provides timely authorized access, is substantiated. The proposed approaches to improving the access control system affect not only the improvement of the existing access model by supplementing it with solutions available in the attribute-based access model, but also the optimization of the role- based access scheme using the developed genetic algorithm and the detection of unauthorized access attempts associated with overcoming access rules, based on application of machine learning methods. Experimental results are presented that confirm the effectiveness of the proposed approaches. Contribution: Igor Kotenko – analysis of the state of the art in the creation and application of the electronic information and educational environment of universities of federal executive authorities, setting the task and developing proposals for developing the functionality of the access control system, development of approaches to genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Igor Saenko – development of approaches to improving the access control system related to the use of an attribute-based access model, genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Roman Zakharchenko – analysis of technical solutions that ensure the implementation of the access control system to the resources of the electronic information and educational environment of universities of federal executive authorities, Alexander Kapustin – analysis of security threats and access control models to resources of the elect","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"81 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125238198","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2022-4-13-25
Yury Yazov, S. Soloviev, Mikhail Tarelkin
Purpose: assessment of the possibility, definition of conditions and a brief description of the relational languages of logical-linguistic modeling for a formalized description and presentation of the processes of implementing information security threats in information systems. Method: application of the logical-linguistic modeling apparatus, which makes it possible to formally describe information security threats and a set of actions performed in the course of their implementation, taking into account the capabilities of relational description languages, such as Codd’s language, context-free plex-language, RX-code language, syntagmatic chains and semantic networks. Result: a brief description and comparative analysis of relational description languages and features that affect the possibility of their use for describing threats to information security and logical-linguistic modeling of their implementation processes are given. The expediency of such modeling is shown when creating promising expert systems designed for automated and automatic analysis of threats, when maintaining a data bank of threats based on the results of monitoring publications about them on the Internet. Examples of constructing formal logical-linguistic descriptions of well-known threats of computer attacks on information systems using RX-code languages and semantic networks are given, proposals are made for expanding the language of semantic networks to describe threats, taking into account new data on threats and methods for their implementation. It is noted that the proposed approach to modeling the processes of implementation of information security threats, as a rule, is applicable in the absence of the need to take into account the time factor when assessing the possibilities of their implementation.
{"title":"Logical-Linguistic Modeling of Security Threats Information in Information Systems","authors":"Yury Yazov, S. Soloviev, Mikhail Tarelkin","doi":"10.21681/2311-3456-2022-4-13-25","DOIUrl":"https://doi.org/10.21681/2311-3456-2022-4-13-25","url":null,"abstract":"Purpose: assessment of the possibility, definition of conditions and a brief description of the relational languages of logical-linguistic modeling for a formalized description and presentation of the processes of implementing information security threats in information systems. Method: application of the logical-linguistic modeling apparatus, which makes it possible to formally describe information security threats and a set of actions performed in the course of their implementation, taking into account the capabilities of relational description languages, such as Codd’s language, context-free plex-language, RX-code language, syntagmatic chains and semantic networks. Result: a brief description and comparative analysis of relational description languages and features that affect the possibility of their use for describing threats to information security and logical-linguistic modeling of their implementation processes are given. The expediency of such modeling is shown when creating promising expert systems designed for automated and automatic analysis of threats, when maintaining a data bank of threats based on the results of monitoring publications about them on the Internet. Examples of constructing formal logical-linguistic descriptions of well-known threats of computer attacks on information systems using RX-code languages and semantic networks are given, proposals are made for expanding the language of semantic networks to describe threats, taking into account new data on threats and methods for their implementation. It is noted that the proposed approach to modeling the processes of implementation of information security threats, as a rule, is applicable in the absence of the need to take into account the time factor when assessing the possibilities of their implementation.","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"143 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130313013","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2021-6-62-67
D. Mikhailov, S. Dvoryankin, Vera Chumanskaya
The relevance of the topic of protecting mobile devices from cyber attacks is due to a significant increase in the number and share of mobile gadgets among modern devices for accessing the Internet. The purpose of the article is to mathematically substantiate and formalize the models of the most common attacks on mobile devices. On the basis of the constructed models, methods are proposed to prevent and neutralize intrusions into the system of smartphones and tablet computers. Method: applied system analysis of the results of generalization and classification of typical types of attacks on mobile devices, elements of the theory of probability. Results: the features of mechanisms for the formation of vulnerabilities of mobile devices were determined. The important aspects of determining the effectiveness of modern technologies for protecting against cyber attacks on mobile devices are identified. A brief overview of the main approaches to mathematical modeling of the most common attacks is given. Additional requirements are formulated for an adequate choice of protection methods depending on the type of attacks. Recommendations are formulated to ensure the security of a mobile device against threats. Methods for reducing the probability of system damage by the most common attacks are proposed.
{"title":"Approaches to Mathematical Simulation of Cyber Attacks on Mobile Devices","authors":"D. Mikhailov, S. Dvoryankin, Vera Chumanskaya","doi":"10.21681/2311-3456-2021-6-62-67","DOIUrl":"https://doi.org/10.21681/2311-3456-2021-6-62-67","url":null,"abstract":"The relevance of the topic of protecting mobile devices from cyber attacks is due to a significant increase in the number and share of mobile gadgets among modern devices for accessing the Internet. The purpose of the article is to mathematically substantiate and formalize the models of the most common attacks on mobile devices. On the basis of the constructed models, methods are proposed to prevent and neutralize intrusions into the system of smartphones and tablet computers. Method: applied system analysis of the results of generalization and classification of typical types of attacks on mobile devices, elements of the theory of probability. Results: the features of mechanisms for the formation of vulnerabilities of mobile devices were determined. The important aspects of determining the effectiveness of modern technologies for protecting against cyber attacks on mobile devices are identified. A brief overview of the main approaches to mathematical modeling of the most common attacks is given. Additional requirements are formulated for an adequate choice of protection methods depending on the type of attacks. Recommendations are formulated to ensure the security of a mobile device against threats. Methods for reducing the probability of system damage by the most common attacks are proposed.","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128799133","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2022-2-63-71
A. Mirzabaev, Alexander Samonov
Objective: develop a method and means to ensure sustainable functioning of the software mission-critical information systems under impact malicious software. Methods: analysis and classification of malicious software and means of protection against it, synthesis and modeling of correct behavior of programs, temporary automata. Study results: the characteristic of methods and means of detecting malware, which using masking methods, rootkit mechanisms and hardware virtualization technologies is given. A methodology for constructing profiles of the correct functioning of controlled programs in the form of a set of permissible execution routes has been developed. A method for monitoring and controlling the correctness of the current state of the computing process by comparing it with reference profiles has been developed. The method allows real-time detection and counteraction of malicious programs, which using various techniques of implementation and masking, including rootkit mechanisms, hypervisors based on hardware virtualization technology, interception and introduction in system functions in RAM.
{"title":"Control Method of the Correct Execution of Programs by Monitoring and Analyzing the Route-Time Parameters of the Computing Process","authors":"A. Mirzabaev, Alexander Samonov","doi":"10.21681/2311-3456-2022-2-63-71","DOIUrl":"https://doi.org/10.21681/2311-3456-2022-2-63-71","url":null,"abstract":"Objective: develop a method and means to ensure sustainable functioning of the software mission-critical information systems under impact malicious software. Methods: analysis and classification of malicious software and means of protection against it, synthesis and modeling of correct behavior of programs, temporary automata. Study results: the characteristic of methods and means of detecting malware, which using masking methods, rootkit mechanisms and hardware virtualization technologies is given. A methodology for constructing profiles of the correct functioning of controlled programs in the form of a set of permissible execution routes has been developed. A method for monitoring and controlling the correctness of the current state of the computing process by comparing it with reference profiles has been developed. The method allows real-time detection and counteraction of malicious programs, which using various techniques of implementation and masking, including rootkit mechanisms, hypervisors based on hardware virtualization technology, interception and introduction in system functions in RAM.","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129185014","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2021-6-78-89
M. Buinevich, K. Izrailov, V. Pokussov
Purpose of the study: increasing the efficiency of an expert in searching for medium-level (in algorithms) and high-level (in architecture) vulnerabilities in the program code due to the innovative paradigm of the language for its presentation. Method: consists in the analysis of relevant works on the subject of approaches, methods and notations for representing algorithms and software architecture with highlighting the strengths and weaknesses of solutions, synthesizing the paradigm for the presentation of the program code and qualitatively assessing the effectiveness of each of the provisions of the paradigm (by contradiction method); efficiency is understood as a combination of its three indicators: the number of type I and II errors, the search time and the cognitive stress of the expert. The results obtained: description of the idea and 7 main provisions of the paradigm of the pseudocode language for a unified description of algorithms and architecture with the maximum necessary and minimum sufficient degree of formalization; the main practical significance of the representations of the program code obtained in this way is their intended use for analysis by an information security expert for the presence of medium and high-level vulnerabilities; also, for each position, their qualitative influence on the performance indicators of vulnerability search by an expert was established.
{"title":"Language of the Program Code Uniform Presentation for Searching Medium and High-Level Vulnerabilities: the Basic Provisions of Paradigm","authors":"M. Buinevich, K. Izrailov, V. Pokussov","doi":"10.21681/2311-3456-2021-6-78-89","DOIUrl":"https://doi.org/10.21681/2311-3456-2021-6-78-89","url":null,"abstract":"Purpose of the study: increasing the efficiency of an expert in searching for medium-level (in algorithms) and high-level (in architecture) vulnerabilities in the program code due to the innovative paradigm of the language for its presentation. Method: consists in the analysis of relevant works on the subject of approaches, methods and notations for representing algorithms and software architecture with highlighting the strengths and weaknesses of solutions, synthesizing the paradigm for the presentation of the program code and qualitatively assessing the effectiveness of each of the provisions of the paradigm (by contradiction method); efficiency is understood as a combination of its three indicators: the number of type I and II errors, the search time and the cognitive stress of the expert. The results obtained: description of the idea and 7 main provisions of the paradigm of the pseudocode language for a unified description of algorithms and architecture with the maximum necessary and minimum sufficient degree of formalization; the main practical significance of the representations of the program code obtained in this way is their intended use for analysis by an information security expert for the presence of medium and high-level vulnerabilities; also, for each position, their qualitative influence on the performance indicators of vulnerability search by an expert was established.","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129997899","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2019-5-19-25
A. Sabanov
{"title":"Levels of Confidence to Identification and Authentication Results During Digital Transformations","authors":"A. Sabanov","doi":"10.21681/2311-3456-2019-5-19-25","DOIUrl":"https://doi.org/10.21681/2311-3456-2019-5-19-25","url":null,"abstract":"","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129629439","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2018-2-16-23
M. Mironov, Mikhail Kleptsov, Larisa V. Lyubimova, Telecommunications on Railway Transport
{"title":"Analysis of Threats and Vulnerabilities of DBMS Oracle","authors":"M. Mironov, Mikhail Kleptsov, Larisa V. Lyubimova, Telecommunications on Railway Transport","doi":"10.21681/2311-3456-2018-2-16-23","DOIUrl":"https://doi.org/10.21681/2311-3456-2018-2-16-23","url":null,"abstract":"","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129441259","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2021-4-61-72
A. Dobrodeev, Fgup Zniis
The purpose of the article: the study of the roleand and meaningof cybersecurity at the present stage of world development as the main factor for ensuring national and international security of the 21st century. Research method: synthesis and scientific forecasting, peer review, comparative analysis of the cybersphere within the system approach. Results: the state and ways of developing cybersecurity of leading foreign countries on the example of the United States, the state and ways of developing cybersecurity and cybersecurity technology in the Russian Federation are presented with justification for discussion proposals on the disclosure of the term and the concept of “cybersecurity.”
{"title":"Cybersecurity in Russian Federation. A Trendy Term or the Priority Technologic Area of Enhancing National and International Security of the XXI Century","authors":"A. Dobrodeev, Fgup Zniis","doi":"10.21681/2311-3456-2021-4-61-72","DOIUrl":"https://doi.org/10.21681/2311-3456-2021-4-61-72","url":null,"abstract":"The purpose of the article: the study of the roleand and meaningof cybersecurity at the present stage of world development as the main factor for ensuring national and international security of the 21st century. Research method: synthesis and scientific forecasting, peer review, comparative analysis of the cybersphere within the system approach. Results: the state and ways of developing cybersecurity of leading foreign countries on the example of the United States, the state and ways of developing cybersecurity and cybersecurity technology in the Russian Federation are presented with justification for discussion proposals on the disclosure of the term and the concept of “cybersecurity.”","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121130916","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.21681/2311-3456-2019-3-63-71
S. Garbuk, D. Pravikov, A. Polyansky, Stc «Stankoinformzaschita»
{"title":"Ensurin APCS Information Security Using the Predictive Protection Method","authors":"S. Garbuk, D. Pravikov, A. Polyansky, Stc «Stankoinformzaschita»","doi":"10.21681/2311-3456-2019-3-63-71","DOIUrl":"https://doi.org/10.21681/2311-3456-2019-3-63-71","url":null,"abstract":"","PeriodicalId":422818,"journal":{"name":"Voprosy kiberbezopasnosti","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132658417","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：