Information Security Specialists Research Articles

ВЫЯВЛЕНИЕ ПРОБЛЕМ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ МЕТОДОМ СИСТЕМАТИЧЕСКОГО ОБЗОРА ЛИТЕРАТУРЫ

The field of information security covers a wide range of technical, organizational and social aspects, requiring information security specialists to take a unique and comprehensive approach to the development, support, operation, evaluation and improvement of information security management systems. An important element of successful information protection is the accurate identification and assessment of risks and vulnerabilities that may become a source of threats. In existing publications, as a rule, it is assumed that specialists have the necessary experience and knowledge to conduct risk analysis. However, in the dynamic world of information technology and threats, an information security specialist faces a huge amount of information and potential risks that are constantly evolving. Because of this, it is an impossible task to keep in mind all kinds of threats to information security. 
 The purpose is to identify actual problems of information security, potentially acting as sources of information security risk, based on the method of systematic review of the literature. Results: 73 actual problems of information security have been identified, which an information security specialist should take into account in his activities. Understanding these issues makes it possible to develop more effective protection strategies, as well as to make informed and informed decisions when developing and applying security measures.

STUDYING THE PSYCHOLOGICAL CHARACTERISTICS OF TEENS WITH A TENDENCY TO ADOPTION FALSE INFORMATION IN SOCIAL NETWORKS

Recently, in the system of social sciences, scientists, journalists and information security specialists have been seriously addressing the problem of fake news. Modern means of communication are increasingly becoming sources of unverified or rumor-based information.

Building an effective network security system of the enterprise based on the method of analyzing hierarchies of quality indicators

The article is devoted to the analysis of the optimal choice of network security systems for enterprises based on the method of pairwise comparison of criteria. The reaction speed, level of protection, integration and reliability of the systems were studied. Considered general requirements for quality and cost. The conclusion is made about the need for a comprehensive approach to system selection and careful consideration of all aspects to ensure effective information protection. The article analyzes the importance of a balanced approach between efficiency and cost when choosing a network security system. The importance of integration with existing systems and taking into account requirements for compliance with security standards is emphasized. The results of the study indicate the need for careful analysis before deciding on the choice of a network security system for the enterprise. Additionally, the article examines the influence of each of the considered criteria on the overall level of enterprise network security and the reliability of information protection. The proposed recommendations on the optimal choice of network security systems can be useful for enterprise management and information security specialists, contributing to the improvement of the overall level of cyber protection. In conclusion, the article offers a comprehensive approach to the selection of network security systems based on an objective comparison of various criteria. Taking into account the speed of response, the level of protection, integration and cost helps enterprises to ensure effective and economical protection of their information resources. The study can be useful both for management deciding on investment in security, and for information security specialists looking for optimal solutions for the specific needs of the enterprise.

Анализ процесса создания безопасной информационной системы предприятия

The article is an analysis of the key stages of the development of a secure enterprise information system. The focus is on highlighting the stages of determining information security objectives, risk assessment, vulnerability identification, as well as the process of making informed decisions in the context of information system security. The article provides detailed recommendations for creating reports on the completed risk analysis and the process of making informed decisions based on the results obtained. As part of the work, the analysis of the processes of compiling a matrix of the probability of the occurrence of threats, building a model of the violator and the stages of building a threat model was also carried out, providing an understanding of effective recommendations for assessing and managing the risks of information security of the enterprise and forecasting threats. The definitions of all the terms used and examples of the access matrix, the threat probability matrix are also given. The components of the intruder models and threat models are indicated. The most common errors in the process of creating a risk analysis report and presenting it to management are noted. The presented analysis serves as an important resource for information security specialists and business managers who are interested in building a reliable and secure information system.

Malware detection and classification using embedded convolutional neural network and long short-term memory technique

The significant growth in the use of the Internet and the rapid development of network technologies are associated with an increased risk of network attacks. As the use of encryption protocols increases, so does the challenge of identifying malware encrypted traffic also increases. Malware is a threat to people in the cyber world, as it steals personal information and harms computer systems. Network attacks refer to all types of unauthorized access to a network, including any attempts to damage and disrupt the network. This often leads to serious consequences. However, various researchers, developers and information security specialists around the globe continuously work on strategies for detecting malware. Recently, deep learning has been successfully applied to network security assessments and intrusion detection systems (IDSs) with various breakthroughs, such as using Convolutional Neural Networks (CNN) and Long Short-Term Memory (LSTM) to classify malicious traffic. But, with the diverse nature of malware, it is difficult to extract features from it. Therefore, existing solutions require more computing resources since available resources are not efficient for datasets with large numbers of samples. Also, adopting existing feature extractors for extracting features of images consumes more resources. This paper therefore solved these problems by combining a 1D convolutional neural network (CNN) and long short-term memory (LSTM) to adequately detect and classify malicious encrypted traffic. This work was conducted on the malware Analysis benchmark Datasets with API Call Sequences, which contains 42,797 malwares and 1,079 goodware API call sequences. The experimental results show that our proposed system has achieved 99.2% accuracy and outperformed all other state-of-the-art models.

Assessment of the level of security (safety of functioning) of automated systems based on their vulnerabilities, formalized using the theory of queuing systems

Objective. The aim of the work is to develop a methodological apparatus, as well as a mathematical model based on the theory of queuing systems designed to assess the level of security of automated systems.Method. The theory of queuing systems is considered as a mathematical apparatus. In particular, the problem of eliminating vulnerabilities was considered as a multi-channel CFR with an unlimited queue. The flow of detected vulnerabilities of the automated system was considered as an incoming flow of applications. The system, due to the possibility of detecting many vulnerabilities in a short time, has a queue of vulnerabilities. Information security specialists responsible for eliminating vulnerabilities in this system are considered as service channels. Despite the possibility of mutual assistance between specialists, this paper considers a situation where each employee is tasked with eliminating a specific vulnerability. The outgoing flow of applications is the flow of eliminated vulnerabilities of the automated system.Result. A methodological and mathematical apparatus for assessing the level of security of automated systems based on their vulnerabilities and the process of eliminating vulnerabilities has been developed. The theory of queuing systems was used as a basis. The assessment of security levels is given depending on the probability of a queue of unresolved vulnerabilities.Conclusion. The developed methodology can be used to assess the level of security of automated systems. And also allows you to assess the sufficiency of resources spent on eliminating vulnerabilities of a specific automated system.

Comparative Analysis of the Methods of Training Information Security Specialists in the Republic of Belarus and in the Republic of Azerbaijan

The article presents the results of studies that were related to the implementation of a comparative analysis of methods for training information security specialists in the field of information technology in the Republic of Belarus and the Republic of Azerbaijan (on the example of the methods used in the Belarusian State University of Informatics and Radioelectronics and at the Azerbaijan Technical University). In the course of study, the method, developed by the authors, was used. The method is based on the analysis of the curricula used in the indicated higher educational institutions for the specialties related to the information security, and on the obtaining the following indicators according to the results of this analysis: the total number of classroom hours allocated in each of the courses for studying academic disciplines related to information technology in general and information security in particular; an indicator that characterizes the share of classroom hours allocated for practical and laboratory work in academic subjects related to information technology in general and information security in particular, from the total number of classroom hours allocated for the studying of these subjects. Based on the results of the study, it was concluded that there is a high degree of similarity in the approaches used in the framework of the methods for training specialists in information security at the Belarusian State University of Informatics and Radioelectronics and at the Azerbaijan Technical University. This makes it expedient to organize joint training of such specialists for the Republic of Belarus and the Republic of Azerbaijan.

Media and сultural agenda in the EU countries against the background of russian military aggression in Ukraine (sociological and contextual research)

The relevance of the problem is due to the importance of the media agenda for the information security of society and the state. The purpose of the study is to analyze the formation of a common media and cultural agenda in the EU countries regarding the coverage of the Russian-Ukrainian war since February 2022. The study uses theoretical (analysis, synthesis, systematization, generalization and interpretation of results) and empirical (data collection, observation, comparison) research methods. The content of online versions of print media that shape public opinion in Poland and Germany was analyzed. The results showed that the Russian invasion of Ukraine in 2022 led to the formation of a common media agenda in the EU, the unanimous recognition of Russia as a party to the conflict and an aggressor country, the realization of a rethinking of EU international policy and the need to identify new strategic partners. German publications recognize the war as a new reality and raise the issue of mobilizing Europe for collective security. Energy dependence on Russia is recognized as a political mistake, and support for Ukraine's statehood and European integration course is expressed through the theme of common European values and solidarity in the fight against the aggressor. The Polish media demonstrate maximum support for both military and civilian Ukrainians from Polish society, sympathy for refugees, and the need to achieve peace through Russia's military defeat. The cultural agenda in the media of both countries is presented primarily through the topic of preserving monuments threatened by military operations on the territory of Ukraine. The results of the study deepen the understanding of the mechanisms of public opinion formation and its influence on political decisions, and are of practical importance for information security specialists, journalists, politicians, diplomats and anyone interested in the role of the media in civil society.

Restriction of the right to information in the interests of national security: The problem of justification

The relevance of this study is conditioned upon the lack of a single theoretical justification for limiting the right to information, even though Ukrainian legislation allows such limitations in the Constitution. The purpose of this study was to analyse certain cases of restrictions on the right to information in the interests of national security and determine ways to justify such restrictions. The methodological framework of this study included the analysis of law enforcement practices concerning the restriction of the right to information. The study established that, despite a considerable theoretical basis in protection of human and civil rights and freedoms, the modern practice of administrative courts is based only on providing a legal assessment of the actions of the Security Service of Ukraine regarding the recognition of information and other activities of the subject of information relations as illegal in the light of the powers and advantages granted to the Service pursuant to Article 10 of the Convention for the Protection of Human Rights and Fundamental Freedoms. The absence of a single mechanism for restricting the right to information in the interests of national security was proved. The paper substantiated that the courts and state bodies of Ukraine, which are responsible for regulating information activities, have not yet developed their own ways and mechanisms for restricting the right to information, which would factor in their practice of providing a legal assessment of each of these cases. It was noted that the basic means of justifying the restriction of the right to information in the interests of national security, as well as any restriction of the right to information, is the use of a “three-part test”. The outlined grounds for localizing the right to information will be useful for scientists, law enforcement officers, and information security specialists for their legitimate application.

Cyber Security against Intrusion Detection Using Ensemble-Based Approaches

The attacks of cyber are rapidly increasing due to advanced techniques applied by hackers. Furthermore, cyber security is demanding day by day, as cybercriminals are performing cyberattacks in this digital world. So, designing privacy and security measurements for IoT-based systems is necessary for secure network. Although various techniques of machine learning are applied to achieve the goal of cyber security, but still a lot of work is needed against intrusion detection. Recently, the concept of hybrid learning gives more attention to information security specialists for further improvement against cyber threats. In the proposed framework, a hybrid method of swarm intelligence and evolutionary for feature selection, namely, PSO-GA (PSO-based GA) is applied on dataset named CICIDS-2017 before training the model. The model is evaluated using ELM-BA based on bootstrap resampling to increase the reliability of ELM. This work achieved highest accuracy of 100% on PortScan, Sql injection, and brute force attack, which shows that the proposed model can be employed effectively in cybersecurity applications.

ІНФОРМАЦІЙНО-АНАЛІТИЧНА СИСТЕМИ ПРОГНОЗУВАННЯ ВРАЗЛИВОСТЕЙ ТА ЗАГРОЗ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ

The paper proposes a block diagram of an information-analytical system for predicting vulnerabilities and threats to information security. The analysis of the conducted research allows us to conclude that in order to solve the problem of research and development of an information-analytical fuzzy system for a logical fuzzy conclusion about the emergence of vulnerabilities and threats to information security, automating the analysis of the message flow of thematic Internet resources, it is advisable to use expert forecasting systems. To solve the problems of predicting vulnerabilities and threats to information security of confidential data based on the flow of thematic messages of Internet resources using the proposed algorithms and method, hybrid-type expert forecasting systems designed for use on general-purpose information and computer technology can be used. The algorithm for predicting vulnerabilities and threats to information security implemented in the information and analytical system based on the analysis of the data flow of thematic Internet resources allows automating the information process of detecting new vulnerabilities and threats, provides information security specialists with the opportunity to assess the degree of security of resources in a timely manner and, if necessary, take appropriate measures for neutralization possible threats and vulnerabilities, thereby increasing the information security of computing computer systems against the implementation of new network computer attacks. An analysis of fuzzy logical inference systems, modern tools for processing large volumes of data, tools for morphological text analysis, and ontology editors was conducted. UML diagrams of activities, sequences of actions, and classes were built to carry out logical modeling of the information system for forecasting vulnerabilities and threats to information security. For the physical modeling of the system, UML-diagrams of deployment and components have been developed. The possibility of implementing an information-analytical system for predicting vulnerabilities and threats to information security based on the analysis of text messages of thematic Internet resources using the following software products is substantiated: DBMS MySQL, ontology editor - Protégé, fuzzy logic inference system - Fuzzy Logic Designer, morphological data analysis tools - Mystem. To evaluate the obtained results, the indicators MAPE, MAE, RMSE for the values of forecasting the occurrence of vulnerabilities and information security threats, as well as smoothed time series calculated on their basis with a period of three and five.

Internet platform for analyzing computer memory of Windows operating systems for conducting information security investigations

Within the framework of this article, an analysis of the dynamics of the growth of information security incidents identified in companies by specialists of the department of monitoring and responding to information security threats was carried out. The study examined the problems faced by information security specialists in companies, and what tools they use to perform their tasks. Countering cyberattacks requires timely response to a recorded incident and accuracy in its investigation. As part of this scientific work, an automated digital platform was developed for analyzing RAM dumps of Windows operating systems for conducting investigations in the field of information security. This tool will provide a digital forensics specialist with additional time to investigate information security incidents by minimizing routine tasks and a centralized information processing location.

МЕТОД ПРОГНОЗУВАННЯ ВРАЗЛИВОСТЕЙ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ НА ОСНОВІ АНАЛІЗУ ДАНИХ ТЕМАТИЧНИХ ІНТЕРНЕТ-РЕСУРСІВ

In the paper, a study of the task of predicting information security vulnerabilities is carried out based on the analysis of the data of thematic Internet resources. Against the backdrop of the rapid development of information technology, there has been an increase in the activity of a variety of computer attacks carried out and planned using modern latest technologies. Harmful information has become an obvious problem in the information security of society today, it should also be noted that criminal and terrorist groups are increasingly adopting means of information influence, developing and writing strategies aimed at attracting new adherents and expanding the sphere of influence through social networks. The analysis of the conducted research of the current state in the field of information security shows that the pace of development of information and computer technologies is significantly ahead of the process of creating software and hardware in the field of information security. The priority in this situation is the task of analysis, classification, identification of active mechanisms and means of attacks and threats to the information security of the system, which can lead to unauthorized access to confidential data, disruption of the functioning of the information system, determination of countermeasures against attacks and threats, assessment of the given damage, development of the legal framework, protection mechanisms and information security criteria of the countermeasure system. Today, there is no single approach to solving the problem of security of information and search systems, in relation to subject areas: developers of hardware and software protection of information offer appropriate components for solving specific problems; ensuring reliable protection of information resources requires the implementation of appropriate technical and organizational measures in a complex, accompanied by the development of appropriate documentation. Most of the modern software and hardware systems for detecting computer threats and attacks work using the approaches of signature analysis and fixing of Internet network anomalies. These approaches have disadvantages associated with the use of powerful computing resources for their implementation, and have low efficiency when detecting new computer threats. The method of predicting information security vulnerabilities based on data from Internet resources, based on fuzzy inference, semantic and statistical analysis, is distinguished by the ability to identify vulnerabilities and threats to their implementation, allows you to describe the patterns of the information process of filling thematic resources with new text messages, which affects the quality of forecasting . The algorithm for forecasting vulnerabilities and threats to information security implemented in the information and analytical system, based on the analysis of the data flow of thematic resources, allows automating the information process of detecting new vulnerabilities and threats, provides information security specialists with the opportunity to assess the degree of security of resources in a timely manner and, if necessary, take appropriate measures to neutralize possible threats and vulnerabilities, thereby increasing the information security of computing computer systems against the implementation of new network computer attacks.

SOFTWARE AND HARDWARE STAND AS A MODERN TOOL FOR TEACHING STUDENTS TO CONFIGURE WIRELESS NETWORKS

Goal. Theoretical justification and development of a software and hardware stand in order to train future information security specialists in setting up modern wireless networks.
 Work methodology or method. The study is based on scientific regulations of the practice-oriented learning organization. The competence-based approach was used as its methodological base, theoretical (comparison, analysis, generalization, concretization, modeling) methods were used. The development and implementation of a software and hardware stand in the educational process was carried out at Tyumen State University in 2021-2022 with the involvement of students from the “Computer Security” direction of training.
 Results. The authors have developed and applied in the educational process a software and hardware laboratory stand that combines virtualization tools for software and hardware components of a computer network.
 The stand is used to study the modern infrastructure of a computer network which is used in enterprises and companies by students of the “Computer Security” specialization. It can also be used while teaching modern wireless networks configuration for students of the directions: “Mathematical support and administration of information systems”, “Computer science and computer technology”, “Software engineering”.
 On the basis of the stand a cycle of laboratory works was developed for senior students of the “Computer security” specialization as part of the study of the “Wireless computer networks security” discipline.
 Scope of results. The results of the study can be applied in the field of training future IT-specialists in the higher education system.

The Effect of COVID-19 on Remote Work Policies

The climate for information security has drastically shifted due to the COVID-19 pandemic. In the past, information security focused on the purview of the office space and the physical infrastructure, with increased specializations in digital architecture such as the Internet of Things, cloud services, and Software-as-a-Service (SaaS). Remote work was often discouraged due to ineffective mitigation strategies, especially when personal devices were involved. Remote work has become commonplace, and information security specialists must adapt to the changing environment. Effective information security policy management for a modern age will include effective mobile and remote usage provisions that maintain the same or similar workflow as on-site activities. Virtualization offers enhanced security for remote work while maintaining set routines.

Staff assistance of educational programs in the sphere of information security: design and development problems

An increase in civilization risks and threats, and the development of information technologies actualize the questions of information security. The need for information security specialists is sharply increasing. This requires the solution of a number of managerial, organizational, substantive issues related to the organization and implementation of educational programs on information security including staffing issues. In such conditions the issues of teaching staff potential development, formation of the necessary up-to-date knowledge and competences of teachers for qualitative training of future specialists become urgent and in-demand. Mass retraining of teachers becomes the most important task in providing information security specialists for the digital economy. The methodological basis of the study is the provisions of education sociology reflecting the problems of matching the human resources needs for the digital economy, import substitution and national security with the quantity and quality of specialist training in higher educational institutions of vocational education.The aim of the research is to identify employers' demands for information security specialists' competences for formation of professional educational programs and demands of teachers engaged in information training for actual knowledge, abilities, skills, which availability will ensure innovativeness in training of young specialists. The main hypothesis was that there is a mismatch between the demands of the external environment of higher education, above all, employers and the capabilities of the educational system, there is an urgent need to increase the capacity of teachers involved in training professionals in the field of information security. The reasons for this mismatch are (1) the dynamic development of technology, the emergence and increase of cyber threats and cyber incidents, (2) the presence of objective problems in the development of educational institutions staff capacity - the low proportion of young personnel, inadequate interaction between educational institutions and industrial and research centers, inadequate scientific and educational mobility of teaching staff for skills development.The needs of employers and teachers have been identified on the basis of empirical research (autumn, 2021) conducted by the authors. 103 teachers and 109 employees of enterprises which carry out functions on maintenance of information security of organizations and enterprises (mainly SFD) participated in sociological research.Results: requirements of employers and teachers on information security actual knowledge, abilities, actual programs of professional development and professional retraining were revealed. The practical significance of the results is that the study can reveal the problems of design and development of educational programs on information security and formulate recommendations for the design.

A method for protecting neural networks from computer backdoor attacks based on the trigger identification

Modern technologies for the development and operation of neural networks are vulnerable to computer attacks with the introduction of software backdoors. Program backdoors can remain hidden indefinitely until activated by input of modified data containing triggers. These backdoors pose a direct threat to the security of information for all components of the artificial intelligence system. Such influences of intruders lead to a deterioration in the quality or complete cessation of the functioning of artificial intelligence systems. This paper proposes an original method for protecting neural networks, the essence of which is to create a database of ranked synthesized backdoor’s triggers of the target class of backdoor attacks. The proposed method for protecting neural networks is implemented through a sequence of protective actions: detecting a backdoor, identifying a trigger, and neutralizing a backdoor. Based on the proposed method, software and algorithmic support for testing neural networks has been developed that allows you to identify and neutralize computer backdoor attacks. Experimental studies have been carried out on various dataset-trained convolutional neural network architectures for objects such as aerial photographs (DOTA), handwritten digits (MNIST), and photographs of human faces (LFW). The decrease in the effectiveness of backdoor attacks (no more than 3 %) and small losses in the quality of the functioning of neural networks (by 8–10 % of the quality of the functioning of a neural network without a backfill) showed the success of the developed method. The use of the developed method for protecting neural networks allows information security specialists to purposefully counteract computer backdoor attacks on artificial intelligence systems and develop automated information protection tools.

CURRENT POLITICAL MAINSTREAMS OF MILITARY EDUCATION

The problem horizon of the current state of Ukrainian military education is quite wide, and the amplitude of conceptual points of view to the development of new models of military education fluctuates within a very wide range. The analysis of theoretical and practical problems has shown the dominance of consensus on the strategic course of the state policy on NATO membership. It was determined that the modern gabitus of the political mainstream of military education today is the National Security Strategy of Ukraine, which is based on the triad of principles “deterrence-sustainability-interaction” and provides for the corresponding processes of national security through modernization of education and science to the needs of social development on the basis of the best world educational models and practices. The article reveals that the intension of military education transformation lies in changing the military education provisions in the Ukrainian legislation and updating its structure, as well as in scientific professional environment, in substantiation and elaboration of the Policy and Concept of military education development, taking into account the NATO standards. The lack of a systematic analysis of the political paradigm of professional education for information security and cyber defense specialists, directed research to identify the main political mainstreams in the training of military specialists in the field of cyber security in the conditions of digital transformation. The Ukraine Cyber Security Strategy Implementation Plan notes the intent of creating a new model for training and professional development of cyber security subjects and developing a Nationwide Cyber Literacy Program for all levels of education. It is proved that cyber awareness of military specialist in the new model of military education becomes a priority sign of his professionalism.

Principles of information security management system

The main element of a complex system that determines its performance and efficiency is its management system. Modern management systems are widely used, including in the management of teams of people united by common goals (organizations, departments, groups of developers, etc.). Information security is no exception - it is not enough to saturate the division responsible for information technology security with personnel, technical systems of information protection, it is necessary to ensure the effectiveness in achieving the goals, which is not possible without an appropriate management system. Information security specialists in organizations of various forms of ownership often face the problem of ensuring effective and efficient protection of information assets. Availability of international and national standards, regulatory documents of regulators does not ensure the achievement of high performance and efficiency indicators. The achievability of these indicators is determined by setting and achieving a number of goals, based on certain strategic principles of information security management system.

CONCEPT OF A TRAINING COMPLEX FOR TRAINING MILITARY INFORMATION AND CYBERSECURITY SPECIALISTS BASED ON A COMPUTER GAME (GAMIFICATION)

Purpose and objectives of the article. To substantiate the concept of building an educational and training complex for training information and cyber security specialists based on a computer game. To achieve this goal, the following tasks are set: 1. Analyze the current state of research and publications. 2.review the concepts of building an educational and training complex for training information and cyber security specialists based on a computer game. Conclusions and prospects for further research. Gamification in higher education allows you to create an information and learning environment that promotes independent, active desire of cadets (students) to acquire knowledge, professional skills and abilities, such as critical thinking, decision-making, working in a team, being ready to cooperate; helps to reveal creative abilities and motivates self-education. At the same time, it is necessary to be careful about the use of gamification. It is clear that the spirit of struggle encourages students to complete tasks faster and better, but if one of the participants gets a result that is much better than the leaders, then under certain attitudes this person may lose heart and decide that there is no point in learning. Based on the positive experience of using computer technologies in training people of different ages, it is considered appropriate to use cybergra in the training of information and cybersecurity specialists. Scientific novelty. Based on the analysis of the current state of gamification and gaps in the field of training information and cybersecurity specialists, the concept of building an educational and training complex for training information and cyber security specialists based on a computer game is proposed. The theoretical results obtained in the course of scientific research form the basis for further research in substantiating the terms of reference for the development of computer software for playing in cyberspace.