MODELS FOR FORMING KNOWLEDGE DATABASES FOR DECISION SUPPORT SYSTEMS FOR RECOGNIZING CYBERATTACKS - Lakhno, В.А.; Akhmetov, Б.С.; Ydyryshbayeva, М.Б.; Yerbol, А. (Bulletin of Abai KazNPU. Series of Physical and Mathematical sciences, 2021)
Patterns of Bayesian networks (BN) have been developed for the computing core of the decision support system (DSS) in the course of threats prediction and stages of intrusion into information and communication networks (ICN) of informatization objects. The proposed Bayesian networks (BN) templates allow one to operate with a variety of random variables and determine the probability of a cyber threat or a specific stage of an invasion under given conditions. Probabilistic models for detecting network intrusions based on the use of dynamic Bayesian networks (DBN) have been added. The training of Bayesian networks parameters based on the EM-algorithm was carried out. In contrast to existing solutions, the proposed approach makes it possible not only to take into account the main stages of intrusions but also to make more reasonable decisions based on the use of both typical intrusion patterns and newly synthesized patterns. All templates and models make up the decision support system (DSS) computing core for intrusion detection. The effectiveness of the developed models was tested on test samples that were not previously used in training.