The analysis of the FTP protocol revealed a number of vulnerabilities in it, which can be used by an adversary to uncover the IDs of data transfer service clients and compromise the used network security features. On the one hand, it is due to the possibility of repeated authorization attempts to unauthorized clients, allowing to implement a data transfer service username and password. On the other hand, the implementation of reactive measures of protection, which consists in breaking the control connection to the adversary after a number of unsuccessful authorization attempts, forcing him to change the strategy of exposure. In this regard, the use of proactive protection measures, allowing to increase the time of dialog interaction with the intruder and imposing restrictions on computing and temporal resources used by the intruder, is proposed as a countermeasure to the network reconnaissance tools. The essence of proactive protection measures consists in splitting the response of FTP server to unauthorized client commands into fragments and sending those fragments to the intruder after a specified delay time. Application of proactive protection gives the security system of information system a number of advantages over the intruder in using the time resource, allowing to implement additional protection measures. The problematic issues when implementing proactive protection measures for data transmission service of information systems are, firstly, the need to send fragments of response to the intruder at intervals shorter than the timeout time of waiting for these responses, set by the intruder. Secondly, the possibility of sending to the violator the limited number of fragments of response, that is caused by FTP protocol capabilities, regulating the size of response, as well as the excessive saturation of the communication channel by fragments of messages, that can lead to exhaustion of the resource opportunities of data transmission medium. Therefore, there is a need to find the optimal parameters of the information system in the configuration of data transmission parameters in the interaction with the network reconnaissance tools. The process of information system՚s data transmission service functioning under the influence of network reconnaissance tools is formalized in the form of a Markov random process with discrete states and continuous time. Intensities of streams of events, under which the system passes from state to state, are the input data for solving the task of finding the optimal parameters of the information system for the situation under consideration. The qualitative formulation of the task of determining the optimal parameters of the information system is formulated as follows: using a given mathematical model of the information system՚s data transmission service under conditions of network reconnaissance we should find such a set of parameters of information system՚s functioning, in which the maximum efficiency of its protection while ensuring a given level of availability is provided. The problem under consideration is a vector (multi-criteria) parametric optimization problem, which will be reduced to single-criteria (scalar) optimization by constraint method (main criterion). Main criterion method implies selection of one scalar target function and transfer of other target functions into additional restriction functions. As the constraints for solving the optimization problem set resource constraints, characterized by the coefficient of the transmission medium, as well as the condition of a given level of robustness of the information system, characterized by the number of conditionality of the matrix of the intensity of the flow of events. The research applies a nonlinear optimization algorithm, an annealing simulation algorithm that provides the ability to approximate the search for a global extremum. The results obtained during the study are presented in the form of an assortment of graphic dependences of changes in the optimal parameters of the information system on the intensity of the impact of network reconnaissance means and the imposed constraints.
Read full abstract