Information Protection System Research Articles

A method of using modern endpoint detection and response (EDR) systems to protect against complex attacks

The subject of the research in this article is the architecture of Endpoint Detection and Response and the EDR agent as their base parts in terms of mechanisms for detecting and countering complex attacks on information and communication systems (ICS). The aim of the work is to develop of method for improving the efficiency of using Endpoint Detection and Response (EDR) to reduce the risks of compromising ICS information, industrial, and infrastructure objects by effectively redistributing and utilizing the available EDR mechanisms, the cybersecurity team, and other resources available for implementing security measures in an enterprise, institution, or organization. The article addresses the following tasks: reviewing and analyzing existing EDR systems, analyzing the architecture of EDR solutions and EDR agents, the features of their use, the logic behind the construction of methods and mechanisms for detecting threats to the system from malicious actors and malicious code. The task of providing recommendations for the organization of ICS is also separately addressed in terms of the need to protect the entire ICS and its individual elements, as well as in terms of the available resources (the cybersecurity team, their qualifications and level of awareness of the architecture of EDR solutions) and means (available EDR system elements) for organizing protection. The following methods are used: modeling attack mechanisms, modeling attacker behavior. The following results were obtained: general and specific recommendations were formulated for optimizing the operation of EDR systems and ensuring the effective use of EDR system elements in the information and communication networks of enterprises, organizations, and institutions of various types and orientations depending on the available resources and the information requiring protection. Conclusions: The identified recommendations for the application of EDR mechanisms for protecting information systems and networks allow optimizing the costs of creating a protection infrastructure and implementing security measures, taking into account the characteristics of the available tools and the training and awareness of the cybersecurity team both in terms of response time to threats and the complexity and cost of performing protection tasks.

Онтологічний підхід в системі забезпечення безпеки використання IP-телефонії

In today's information world, the use of VoIP has become an attractive option for user communication. With the downward trend in paying for basic broadband services and the rapid increase in internet speeds, the use of VoIP should only continue to grow in popularity. However, as the use of VoIP increases, so do the potential threats to ordinary users. This article examines the peculiarities of organizing corporate VoIP telephony systems, highlights the main problems in information protection systems in VoIP telephony, and outlines ways to solve them. The development of methods for speech analysis and corresponding processing of natural language, which allows for creating more accurate and effective systems for detecting anomalous traffic and potentially dangerous communications, is especially relevant. With the continuous development of artificial intelligence technologies, the direction of using intelligent means for content analysis in the VoIP system is becoming interesting. A method for detecting anomalies in IP-telephony traffic, based on grouping VoIP messages through context-frequency analysis, is proposed. Additionally, a method for automated filling of the ontology of thematic messages in corporate IP-telephony systems is proposed, based on the formalized presentation of messages using tree-like structures and the description of interaction operations through tuple algebra. Furthermore, a software implementation for converting voice messages into text representations using the SpeechRecognition library for voice-to-text conversion in the Python programming language was created. Experimental studies of the proposed approaches were conducted, and a software subsystem for detecting anomalous messages based on the ontological approach was implemented in the current corporate IP-telephony system.

Information Systems Security, Detection and Recovery from Cyber Attacks

Cyber attacks have become a major concern for organizations and individuals a like, as they continue to evolve in sophistication and scale. In response to this growing threat, information systems security has emerged as a critical area of research and practice. The objective of this study is to investigate and analyze various aspects related to information systems security, detection, and recovery from cyber attacks. The research methodology employed in this study encompasses a comprehensive literature review, case studies, and interviews with experts in the field, in order to identify key concepts and best practices in information systems security. The findings of this research reveal that effective measures for protecting information systems from cyber attacks involve a multi-layered approach, comprising of technical, organizational, and human factors. Technical measures involve the implementation of robust security systems, such as firewalls, intrusion detection systems, and encryption protocols, to safeguard against unauthorized access. Furthermore, regular system updates and patches are crucial in mitigating vulnerabilities and preventing potential breaches. Recovery from cyber attacks is a critical aspect that organizations should consider. Prompt and effective response is crucial to minimize the impact of cyber attacks and restore normal operations. This study emphasizes the importance of having a well-defined incident response plan, which includes steps for containment, eradication, and recovery. Additionally, regular backups and disaster recovery plans are essential for data and system restoration. This research highlights the importance of information systems security, detection, and recovery from cyber attacks. It provides insights into the various measures and strategies that organizations can adopt to protect their systems and data. The findings of this research contribute to the existing body of knowledge in the field of information systems security and serve as a valuable resource for practitioners and policymakers. Further research in this area is recommended to address the evolving nature of cyber threats and the advancements in security technologies.

INFORMATION TECHNOLOGY FOR TESTING STATISTICAL REGULARITIES OF COMPUTER SOFTWARE GENERATOR

Abstract.In the paper, an overview of software generators of pseudorandom variables is carried out, the scope of application of pseudorandom variables is given. The total number of criteria for checking the statistical regularities of computer program generators was determined, and five criteria, which are most often used for checking in computational experiments, were studied. The conducted research confirmed the need to check the statistical regularities of computer generators, because this is especially important when applying them in computational experiments and applying the obtained results in various fields of knowledge (cyber security, simulation modeling, technical information protection systems, modeling of military operations, measuring equipment and computer computer games). Among such criteria are defined in the article: the Sherman, Chang-Spiring, Moran, Fronzini, and Greenwood-Quesenberry-Miller criteria. In the course of the research, it was determined that the following generally accepted requirements must be observed when designing and implementing generators of pseudorandom sequences: simplicity of hardware or software implementation; maximum speed; maximum approximation of the sequence obtained at the output of the generator to the theoretical law of distribution (not necessarily uniform); the ability to control output parameters; the possibility of operation of generators of pseudorandom sequences in a wide range of frequencies; the ability to quickly reconfigure its work depending on the choice of initial parameters. Thus, the development of information technology will allow to automate the process of checking statistical regularities of computer software generators and will provide an opportunity to ensure the adequacy and correctness of the results of statistical analysis.

Research on Evaluating Information Security Level Protection by Data Mining Method

Information technology’s continuous development and progress can bring great changes to society, which is also born in the hierarchical protection of information systems. Among them, grade protection evaluation is the key part, and methods to find useful information from its complicated evaluation data to assist decision-making have become an important content of research. Aiming at the evaluation process of data mining, this article intends to analyze the classical algorithms of association rules. The Apriori algorithm and FP-growth, two common and representative algorithms, are chosen as a comparison. Finally, it is found that the performance of the latter is better than that of the former. The rationality of association rules is proved by analysis to better assist the evaluators in the evaluation work and reduce the misjudgment of the evaluation results.

Legal Considerations on Personal Information Protection Systems that Use Blockchain

Legal Considerations on Personal Information Protection Systems that Use Blockchain

Exploring the Path of Personal Information Infringement Governance by Web Crawlers

In the era of big data, the explosive growth of data information, network crawler as a new type of data search engine came into being, and gradually become indispensable technology. However, with the continuous penetration of crawler technology, related infringement problems have gradually surfaced. This topic starts from the definition and technical application of network crawlers, further analyzes the specific forms of network crawlers’ personal information infringement, and discusses and summarizes the shortcomings of the legal governance measures involved, and finally draws on the experience of overseas and combines the views of relevant scholars, proposes to improve the relevant legal provisions and clarify the division of responsibility; introduces the rule of balanced trial; establishes the criteria for the reasonable use of data by crawlers; creates a “cyclical protection system”; establishes the “data protection system”; and establishes the “data protection system”. The proposal to establish a cyclical protection system, establish a “data protection officer”, set up an independent regulatory body, form an internal and external linkage mechanism, and then build a scientific governance system for scientific governance.

Analisis Implementasi Keamanan Sistem Informasi pada Perusahaan Herald Sulsel

As a company that manages large amounts of sensitive data, information system security is a critical factor to protect important company information and maintain data integrity and availability. This article aims to analyze the implementation of information system security at the Herald Sulsel Company, as well as identify the steps taken by the company to protect its information system. This study uses a qualitative approach by collecting data through interviews with key personnel involved in information system security management, as well as through a review of existing security documents and policies. The results of this analysis provide an in-depth understanding of employee awareness of the importance of information system security, the company's efforts to protect information system security and internal and external network management to prevent security attacks. The findings of this study indicate that the Herald Sulsel Company has implemented a number of effective security measures. Herald Sulsel uses its own and third party server systems to prevent unauthorized access to their network. Encryption and authentication are also used to protect sensitive data sent over the network.

МОДЕЛЮВАННЯ МУЛЬТИАГЕНТНИХ СИСТЕМ ЗАХИСТУ ІНФОРМАЦІЙНИХ РЕСУРСІВ

Traditional centralized information protection systems do not provide an adequate level of adaptability and efficiency in a dynamically changing threat environment. Multi-agent systems, having a distributed architecture and the possibility of autonomous decision-making, represent a promising direction for solving information security problems. The novelty of the research lies in the development of a multi-agent information protection system with enhanced capabilities for vulnerability analysis and intrusion detection. Unlike existing solutions, the proposed system provides active analysis of threats, reduction of the number of false positives, adaptation to new types of attacks, and minimization of the impact on the target traffic of information flows. In the proposed formal model and prototype of the agent-oriented attack modeling system (ASMA), distributed coordinated attacks on a computer network are considered as a sequence of joint actions of hacker agents, which are performed from different hosts. Hackers are supposed to coordinate their actions according to some common script. At each step of the attack scenario, they try to implement a specific private subgoal. The developed agent-oriented attack modeling system (ASMA) allows simulating distributed coordinated attacks on computer networks. It is based on a hierarchy of grammars, each of which is interpreted as a finite automaton. The system takes into account both macro- and micro-levels of attack description, providing detailed simulation of each stage of the attack. The use of KQML for communication between agents and XML for describing the content of messages allows effective coordination of agents' actions and ensures realistic simulation of attacks.

High-security multidimensional data protection system based on the Hartley algorithm-driven chaotic scheme

This paper proposes a high-security multidimensional data protection system based on the Hartley algorithm-driven chaotic scheme. We utilize the fast Hartley algorithm instead of the fast fourier computation, and we employ chaotic sequences generated by the multi-winged chaotic system to achieve chaos-driven 3D constellation mapping, effectively integrating the chaotic system with the stochastic amplitude modulator. We reduce the signal’s peak-to-average power ratio (PAPR) by deploying a random amplitude modulator. Simultaneously, this approach enhances the security of the physical layer of the signal. The PAPR reduction can reach up to 2.6 dB, while the most robust and stable modulator scheme can gain 2 dB. Finally, in the Hartley frequency domain, the signal's frequency is disrupted, providing the entire system with a key space of 10131 to resist violent cracking and thus improving the system's overall security. To validate the feasibility of our scheme in comparison to conventional IFFT-based encrypted 3D orthogonal frequency division multiplexing, We achieved a transmission rate of 27.94 Gb/s over a 2 km multicore fiber. Experimental results show that since the random amplitude generator effectively reduces PAPR, our proposed encryption scheme increases the forward error correction threshold range by 1.1 dB, verifying that our proposed scheme has highly reliable security performance.

МЕТОД ДВОКАСКАДНОЇ ІМПЛАНТАЦІЇ ПРИХОВАНОЇ ІНФОРМАЦІЇ НА ОСНОВІ СТЕГАНОКОМПРЕСІЙНИХ ПЕРЕТВОРЕНЬ

In the article, the need for further development of the state is directly related to: solving issues of increasing defense capability and information security; development of information and intelligent systems. The necessity of ensuring the required level of completeness of information, compliance with the requirements of its relevance, achievement and maintenance of the appropriate level of integrity, accessibility and confidentiality is substantiated. The article emphasizes that for this purpose, complex systems of coding and information protection are being built. It is shown that recently, in order to further increase the level of security of information resources, methods of hidden embedding of information have been used. In this field of scientific and applied research, the direction of timely delivery of integral video information in a secure mode is outlined. For protection, the following can be used: meta-messages, which are formed on the basis of intelligent analysis of video frames; separate video segments of aerial photographs containing the most important information for decision-making. This article examines a class of methods of steganographic transformations, which are associated with embedding messages in digital containers, which are formed by a stream of video segments (VS). However, existing steganographic systems are based mainly on the use of the amount of psychovisual (PSV) redundancy available for reduction. Therefore, an increase in steganographic capacity leads to a loss of integrity and efficiency of delivery of video-container information. Steganocompression coding in the stegano-polyadic basis was created on the basis of taking into account the amount of redundancy permissible for reduction. In this case, in the process of compression of the components of the VS, the direct embedding of hidden information is organized. Concealment of information is carried out by technological stages, depending on the compression transformation of the transitional syntax of the quilted sequence. The key stage is the technology of two-stage implementation of the elements of the concealed message added to the stegano sequences to the syntax of the steganocompression representation of the BC components.

A STRONG AND PRACTICAL AUTHENTICATION MECHANISM USING PASSTEXT AND ONE MINUTE PASSCODE

In this modern world, hacking is growing faster, and there is no privacy for personal data. Therefore, we have decided to create passwords using new methods. This project demonstrates that there is no secret shared between the user and strangers; it presents a one minute challenge to unlock private data. Our project generates random codes minute by minute, and each password is only valid for just one minute, which is called OMP (One Minute Passcode). Therefore, the user doesn't know the correct password at all times. These passkeys are then sent to the user's mobile phone using the Twilio method, which is more secure and provided by Google to communicate through secret authentication methods and tokens. Thus, hacking becomes impossible with this level of complexity. In the future, if there's a possibility of hacking, we will update the cipher methods to unlock the data. Nowadays, the usage of PCs and mobile phones has increased rapidly. What if the passwords are not known by the user or strangers in this modern technology. Our project ensures privacy between users and hackers or strangers; secret passwords may sometimes be compromised, but random passwords will never be known to users or strangers. This idea is used here to maintain safety while unlocking our privacy or private sectors by creating random codes and sending them to the user's mobile IP value or number. We can easily unlock our device in a non-hackable form using brute force and Twilio, which are the main components of our data protection system. In the older authentication method, there were only 6-digit numbersto unlock data, which were available only for apps. Like an OTP, this method randomly generates a 6-digit code to unlock the private sector, which is available on the same phone or PC. This makes it easy for hackers to access details using your phone number or email. These passkeys are dynamic and not stable at all times, and theirsize istoo small. A relational database plays a major role here, we also use the emergency password method for user convenience. KEYWORDS: Security Authentication, Twilio, Database, Spyware attacks, Hacking, Password Authentication,Database.

Colombian Ocular Diseases Epidemiology Study (CODES): Prevalence Incidence, and Sociodemographic Characterization of Vision Impairment (2015–2019), A Nationwide Study

ABSTRACT Purpose To describe the prevalence, incidence, and sociodemographic characterization of moderate to severe vision impairment (MSVI) and blindness in Colombia based on the National Health Registry Integrated Social Protection Information System (SISPRO) Database. Methods We performed a nationwide population-based study using SISPRO and the International Classification of Diseases. Total and new cases were identified to calculate the prevalence and incidence per 100,000 inhabitants of MSVI and blindness between 2015 and 2019. Blindness was defined as a best-corrected visual acuity (BCVA) of less than 20/400 in the better-seeing eye. Meanwhile, MSVI is a BCVA from 20/70 to equal or better than 20/400 in the better-seeing eye. An ANOVA test was performed to identify age differences. A conditional autoregressive model was also employed to depict standardized morbidity rate maps. Results From the 50 million inhabitants, the average prevalence and incidence of MSVI were 13.94 and 13.34 between 2015 and 2019, respectively, while for blindness, they were 4.03 and 3.53. Females accounted for most reported cases, and there was a notable shift towards individuals over 50 years (p < 0.001). Valle del Cauca was the region with the most cases reported and the greatest disease burden. Conclusion This is the first nationwide population-based study describing the prevalence, incidence, and sociodemographic characterization of blindness and MSVI in Colombia. In recent years, there has been an increased number of cases, prevalence, and incidence, with females over 50 particularly affected. This research provides insight into the country’s vision impairment epidemiology landscape and contributes to formulating public health policies to improve eye health care.

Artificial intelligence in the sphere of cybersecurity: innovations, challenges, and development prospects

The relevance of the study is due to the need for effective protection of information systems in the face of ever-growing cyber threats. In the modern digital world, where cyberattacks are becoming increasingly complex and widespread, the use of artificial intelligence in cybersecurity is extremely relevant. The problem of cybersecurity is becoming increasingly important and conducting relevant research is becoming a necessary aspect of ensuring security in the digital space.In this context, we propose an article that examines the role of artificial intelligence, innovations, challenges, and prospects of its development in the sphere of cybersecurity. Additionally, it explores the utilization of artificial intelligence for automating processes of detecting, analysing, and responding to cyber threats, and its practical significance for enhancing security levels in the digital space and the effectiveness of cyber threat protection. The main approaches for this study are trend analysis and expert assessments, which allow for a comprehensive review of the directions of artificial intelligence development in the field of cybersecurity, the benefits and challenges of its implementation, as well as potential opportunities and threats to information security. The article discusses advanced security information and event management systems designed to collect, analyse and respond to cyber threats and other systems aimed at specific aspects ofprotection and expanding automation capabilities to improve the security level of information systems. The materials of the article are of theoretical value for further scientific research on the use of artificial intelligence in the sphere of cybersecurity and reflect important features of its influence on this area. This research can contribute not only to deepening the understanding of the theoretical aspects of the use of artificial intelligence in cybersecurity but also to identifying specific practical applications and innovations that will help improve protection against cyber threats in the future.

Design of storage benchmark kit framework for supporting the file storage retrieval

An open-source software framework called the storage benchmark kit (SBK) is used to store the system benchmarking performance framework. The SBK is designed to perform any storage client or device using any data type as a payload. SBK simultaneously helps number of readers as well as writes to the storage system of large amounts of data as well as allows end-to-end latency benchmarking for multiple writers and readers. The SBK uses standardized performance measures for comparing and evaluating various storage systems and their combinations. Distributed file systems, distributed database systems, single or local node databases, systems of object storage, platforms of distributed streaming and messaging, and systems of key-value storage are the storage solutions supported by SBK. The SBK supports various storage systems like XFS, Kafka streaming storage systems, and Hadoop distributed file system (HDFS) performance benchmarking. The experimental results show that a proposed method achieves execution time of 65.530 s, 40.826 s and 30.351 s for the 100k, 500k and 1000k files respectively which ensures better improvement than the existing methods such as simple data interface and distributed data protection system.

The Cyber Kill Chain Model and Its Applicability on The Protection of Students Academic Information Systems (SAIS) in Tanzanian HEIs

The Cyber Kill Chain Model and Its Applicability on The Protection of Students Academic Information Systems (SAIS) in Tanzanian HEIs

РАЗРАБОТКА АЛГОРИТМА ОЦЕНКИ ЭФФЕКТИВНОСТИ МЕР И СРЕДСТВ ЗАЩИТЫ ПЕРСОНАЛЬНЫХ ДАННЫХ В СФЕРЕ ЗДРАВООХРАНЕНИЯ

The features of existing directions and methods for assessing the effectiveness of information protection measures in medical institutions are considered. A comprehensive analysis of objects and identifying threats to the security of personal data is carried out. The authors identify key stages of the object research, consisting of determining the cost of information resources, identifying the most relevant threats, and calculating the damage from their application. The analysis of the possibility of implementing and eliminating threats is performed; a classification of the most critical threat groups is built. The main scientific result of the performed research states that this algorithm application is possible both for scientific purposes and for forming effective personal data protection systems in various organizations. Based on this, this study will lead to increasing the level of the effectiveness assessment for the protection measures of confidential information in medical organizations.

Colombian Ocular Diseases Epidemiology Study (CODES): Prevalence and Sociodemographic Characterization of Refractive Errors in Colombian Eye Care Consultations

ABSTRACT Purpose To estimate the prevalence and demographic characteristics of uncorrected refractive errors (URE) in people who attended eye care consultations in Colombia between 2015 and 2019, using the National Health Registry data. Methods We identified ICD codes for myopia (H-52.1), degenerative myopia (H-44.2), hyperopia (H-52.0), and astigmatism (H-52.2) from the Integrated Social Protection Information System. Crude prevalence rates by age and sex were calculated for the population attending eye care services during these years. Additionally, we developed a standardized morbidity map across county departments. Results In Colombia, the prevalence of URE among eye care consultations was 30.26%, increasing from 30.39% in 2015 to 35.14% in 2019. Of the 1,579,778 cases analyzed, 60.9% were females. Astigmatism emerged as the most prevalent URE, predominantly seen in individuals under 40 years old. Myopia showed the highest prevalence in the 10–30 age group, whereas hyperopia was most prevalent in the first decade of life. Geographically, the Andean region recorded most of URE cases, while more remote areas have seen a rising morbidity risk in recent years. Conclusions The rising trend of URE in Colombia and its demographic and geographical variations underscores the urgent need for health professionals and government authorities to acknowledge and address this issue. This study provides crucial insights into the refractive error landscape across the country, highlighting the necessity for prevention programs specifically designed to cater to the country’s unique needs.

Model of current threats to security of confiden-tial data in divisional information systems

The paper proposes a model for determining actual threats to the information security of distributed information systems, based on algorithms of fuzzy inference and the theory of fuzzy neural systems, unlike known ones, uses sufficient and necessary indicators, excludes expert errors, increases the detection of the number of actual threats to information security of distributed systems by 5 %, reduces the cost of purchasing information protection equipment from 15 to 30%. It takes into account the following factors: the IT infrastructure of the distributed information system, the capabilities of attackers and their level of motivation in the distributed information system, the list of existing protection tools in the distributed information system.&#x0D; The proposed approach differs from existing ones in the following: lack of involvement of highly qualified specialists in the field of information security; the process is automated, has a low computational complexity; absence of deficiencies in expert assessments; allows you to determine the list of current information security threats in information systems of various classes and types.&#x0D; The task of ensuring the security of confidential information becomes the most urgent, which is due to the growth of computer attacks and leaks of information, which are reflected in the statistical data on the commission of crimes in the field of high technologies, the growth of criminal activity using modern communication devices and the Internet.&#x0D; Existing methods of modeling current threats to information security and assessing the effectiveness of the information protection system cannot be used at all stages of the life cycle of distributed information systems - they do not take into account the following indicators in the complex: IT infrastructure of distributed information systems, current threats to information security, security requirements for confidential information, a list of means of protecting confidential information and their value as important indicators when solving these problems.&#x0D; In order to achieve the goals of ensuring the security of confidential information, it is necessary to: organize the effective creation of an information protection system (information security system), effective modeling (identification of the list) of current threats to information security, identification of the current violator, and also provide the opportunity to conduct a qualitative assessment of the effectiveness of the information security (protection) system.&#x0D; One of the most important tasks of ensuring the security of confidential information is the assessment of the effectiveness of the protection (security) system. In this regard, the goal of the work (research) is to improve the quality of the evaluation of the effectiveness of the protection (security) systems of distributed information systems by determining sufficient and necessary evaluation indicators using modern (promising) information technologies that allow the most effective solution of the following tasks: determination operating parameters of adaptive production fuzzy neural systems, which are most suitable for solving the tasks, application of Data Science technologies in data processing, fuzzy output algorithms.

Development of the sociocyberphysical systems` multi-contour security methodology

The constant increase in the number of threats to the security of critical infrastructure objects, which include socio-cyberphysical systems, leads to a decrease in the quality of security services and the level of security of infrastructure elements. The object of research is the process of building a complex system of protection in socio-cyberphysical systems. The imperfection of the mechanisms for ensuring the security of critical infrastructure objects, which include socio-cyberphysical systems, the technological complexity of identifying new security threats necessitates an urgent need for a radical revision of the current approaches to its provision. So, it becomes clear that the development of a new approach to ensuring the security of information resources in socio-cyberphysical systems is needed. The article proposes a new approach to the methodological foundations of building multi-contour information protection systems with internal and external circuits on each of the platforms of socio-cyberphysical systems. This approach is based on a universal classifier of threats, which takes into account not the technical aspect of threats, but also their integration with social engineering methods, their synergy of hybridity. The sociopolitical influence on the realization of threats is taken into account, and practical mechanisms for providing basic security services based on post-quantum algorithms are also proposed. To provide basic security services in the proposed multi-contour protection system, it is proposed to use post-quantum algorithms – McEliece crypto-code constructions, which provide Perr=10-9–10-12, safe time Tsec=1025–1035 group operations. Within the framework of the proposed approach, the problem of increasing the level of information security has been formalized and further ways of solving it have been determined