ARCHITECTURE OF ADAPTIVE PROTECTION SYSTEM FOR SENSOR NETWORK

38Адаптивная система защиты сенсорных сетей от активных атак Вопросы кибербезопасности. 2022. No 6(52) Architecture of AdAptiVe protection system for sensor netWorK Basan A.S.6 , Basan E.S.7 , Peskova O.Yu.8 , Sushkin N.A.9 , Shulika M.G.10 Purpose: Development of the adaptive protection system architecture for sensor networks and cyber-physical systems for anomaly detection based on the collection and analysis of cyber-physical parameters. Method: The method is based on the use of probability theory, mathematical statistics, and information theory. The entropy measure and normalization of the raw data make it possible to unify the data and evaluate it in terms of anomaly detection. Results: The existing solutions for the protection of cyber-physical systems from external active attacks were analyzed. The architecture of an adaptive system for a cyber-physical system protection is proposed. As part of the representation of the node data collection and analysis subsystem, a method for estimating cyber-physical parameters to detect intrusions is proposed. Three parameter changes for four behavioral scenarios were analyzed in detail in this study. Even by three parameters, you can determine the difference between attacks and normal behaviors. It is possible to evaluate not only the fact of parameter change, but also the degree of its change. At the same time, the node autonomously compared changes in its parameters with changes in the parameters of the neighboring node and could identify the impact of the attack on the neighboring node. The scientific novelty primarily consists in the fact that for the first time a method for determining the abnormal activity of a cyber-physical system based on the evaluation of system parameters using a measure of entropy and normalization of raw data has been developed, which makes it possible to achieve a high level of detection of known and unknown attacks. This method can be effectively used also for autonomous systems. The original architecture of the adaptive system for protecting the cyber-physical system is also proposed, its main components are worked out. When implementing an attack in a distributed system, this development will allow the node to detect anomalies not only autonomously, but also distributed, that is, to detect the impact on neighboring nodes.