Infrastructure Protection Research Articles

Critical Entities Resilience Assessment (CERA) to small-scale disasters

Since 2022, there has been a significant increase in the importance of critical entities in terms of critical infrastructure protection. The adoption of the Critical Entities Resilience Directive must in EU member states ensure not only the protection of critical infrastructure, but also a sufficient resilience level of the entities themselves. This directive obliges critical entities to take measures to increase their resilience but does not provide any methodological support. A necessary starting point for fulfilling this obligation is knowledge of the current state of critical entities resilience to small-scale disasters. The results of the resilience assessment will then enable critical entities to identify vulnerabilities on the basis of which adequate technical, security and organisational measures can be defined. Therefore, this article presents an entirely new semi-quantitative method, CERA, which has been developed for the comprehensive assessment of entity and infrastructure resilience of critical entities. At the core of this method is a procedure that allows critical entities to self-assess their internal resilience through individual factors, which are defined in detail in this article. In order to facilitate the assessment process, the authors of the article have created the CERA Support Tool, which is supplementary material to this article. The Results section of the article also includes a presentation of a practical application example of the proposed procedure.

Insurgent climate adaptation in Santiago de Cali: Resisting and reshaping flood-risk resettlements

Climate adaptation in Latin American cities involves navigating highly contested social and cultural terrains. In cities with black and indigenous communities they are confronted with challenges such as histories of racial exclusion and informal, self-built housing in high-risk areas. This study examines Project Plan Jarillón, a flood protection infrastructure project in Santiago de Cali which involves Latin America’s largest relocation project. Cali, home to a large Afro-Colombian population, is also one of Colombia’s fastest growing cities and the second largest reciever of internally displaced persons (IDPs) in the country. The study, based on 5 years of fieldwork including site visits and interviews, found the city’s failure to account for the segregation of black residents in high-risk areas has led to resistance, conflict and delays in the completion of the project. However, by forming an insurgent planning practice which draws from local culture and traditions of resistance, Afro-Colombian communities re-centered public debate on demands for racial and cultural recognition, and the right to decent housing. This insurgent planning is creating more democratic forms and approaches to climate adaptation in Cali at a pivotal moment in Colombia’s history as it negotiates a post-conflict process and positions itself as a global advocate for climate justice.

Ad Hoc Adaptations to Climate Change in Coastal Communities

Climate change disproportionately impacts coastal residents in the United States. Existing studies document institutional efforts to adapt to sea level rise through projects like seawalls, beach nourishment, and property acquisitions to protect communities from rising seas. Such studies capture institutional adaptations, but do not include ad hoc adaptations by homeowners impacted by climate change. How are homeowners adapting to climate hazards? This paper analyzes ethnographic and interview data from 100 households in two coastal counties in North Carolina, a state with one of the most climate vulnerable shorelines in the country. This analysis of homeowner response considers ad hoc adaptations along the North Carolina coast. Results show that homeowners recognize climate hazards and regularly adapt on their own within the context of institutionally maintained flood protection infrastructure and transportation access to the places where they live. Residents are aware of and attempt to access support for home adaptations when programs or funds are available to them after disasters and do so with varying levels of success, though the more pervasive adaptations to chronic stress are not supported by government programs or insurance mechanisms. Ad hoc adaptations may provide short-term protection from climate hazards but have questionable long-term efficacy as sea levels rise and storm strength and frequency increases. Leaving communities and households to adapt on their own as chronic climate hazards outpace institutional response exacerbates existing inequalities by relying on residents with different levels of resources and agency to adapt.

Building risk assessment methodology for explosive and non-conventional terrorist attacks

An original methodology suitable for the assessment of the risk of a terrorist attack in a given site/building is proposed and illustrated for the case of an explosive or non-conventional (Chemical, Biological, Radiological, Nuclear and explosive—CBRNe) attack. The Building Risk Assessment Methodology discussed in this paper represents the arrival point of a detailed analysis and research carried out during the past 5 years and provides the synthesis of different results obtained for the assessment of Building Threats and Building Vulnerabilities. These two assessments were discussed in detail in other already published papers. The effort presented in this work is to deploy a risk and impact assessment technique for buildings that can be adopted in any operating scenario in the presence of explosive or non-conventional threats. The main target of the methodology is to provide a sufficiently accurate estimate of the risk in a simple fashion. The methodology allows to manage the different kinds of risk related to the explosive and non-conventional threats, and it is useful for identifying a ranking of risks for different buildings in different portions of territory and for prioritizing actions and investments in preparedness, protection and resilience of critical areas and critical infrastructures. In the paper, the results of two different case studies for three different threats will be considered, analyzed and compared.

Developing intelligent cyber threat detection systems through quantum computing

In the face of increasingly sophisticated cyber threats, traditional detection systems often fall short in protecting critical supply chains. This research presents the development and evaluation of an intelligent cyber threat detection system integrating Quantum Computing (QC) and Artificial Intelligence (AI). The proposed system significantly enhances detection accuracy, reduces latency, and improves resource efficiency compared to traditional methods. Quantum algorithms, such as Quantum Support Vector Machines (QSVM) and Quantum Neural Networks (QNN), demonstrated superior performance with accuracies of 95.2% and 96.7%, respectively. The system achieved high detection rates for various cyber threats, including malware, phishing, ransomware, and advanced persistent threats (APTs), with reduced false positive rates. The integration of QC also resulted in faster threat detection and response times, with system latency halved across key components. These advancements provide substantial benefits for cyber threat response in supply chains, ensuring robust protection of financial transactions and critical infrastructure. The enhanced scalability and efficiency make the system a valuable asset for safeguarding the United States' financial sector against sophisticated cyber-attacks.

Climate Change and Ecosystem Services: A Participatory Approach in a Brazilian Mountainous Region

Climate change is present in all sectors of global societies, causing various damages, including to agriculture. In this process, understanding the perception of the most affected population and including them in decision-making is a matter of social justice and a more assertive path. Aiming to obtain subsidies for better adaptation to climate change in family farming, this study established a methodology for evaluating the risks of climate change impacts on ecosystem services, related to water and food security, under the perception of rural actors in the mountainous region of the Rio de Janeiro state, Brazil. The methodology consisted of five steps, including the application of the questionnaire to 29 rural actors and ending with validation of the results in a focus group. The main results obtained were that the interviewees perceive the risks of the impacts of climate change in ES, both related to water and food security. Additionally, 24.14% of interviewees mentioned that their family has a monthly income below the Brazilian minimum wage, which exposes their food insecurity. In relation to water security, the risks classified as Very High were mainly in relation to low per capita investments in adaptation policies and infrastructure for environmental protection, between others. The use of many chemical inputs in agriculture also highlighted as a risk to water and food security. Regarding the methodology, it concluded that it was effective in obtaining the perception of the rural actors interviewed regarding the impacts of climate change on ecosystem services at a local scale.

Proactive Threat Hunting in Critical Infrastructure Protection through Hybrid Machine Learning Algorithm Application.

Cyber-security challenges are growing globally and are specifically targeting critical infrastructure. Conventional countermeasure practices are insufficient to provide proactive threat hunting. In this study, random forest (RF), support vector machine (SVM), multi-layer perceptron (MLP), AdaBoost, and hybrid models were applied for proactive threat hunting. By automating detection, the hybrid machine learning-based method improves threat hunting and frees up time to concentrate on high-risk warnings. These models are implemented on approach devices, access, and principal servers. The efficacy of several models, including hybrid approaches, is assessed. The findings of these studies are that the AdaBoost model provides the highest efficiency, with a 0.98 ROC area and 95.7% accuracy, detecting 146 threats with 29 false positives. Similarly, the random forest model achieved a 0.98 area under the ROC curve and a 95% overall accuracy, accurately identifying 132 threats and reducing false positives to 31. The hybrid model exhibited promise with a 0.89 ROC area and 94.9% accuracy, though it requires further refinement to lower its false positive rate. This research emphasizes the role of machine learning in improving cyber-security, particularly for critical infrastructure. Advanced ML techniques enhance threat detection and response times, and their continuous learning ability ensures adaptability to new threats.

Age, gender and household infrastructural inequality in COVID-19: Contextual analysis of Mamelodi.

Age, gender and household infrastructure are important social determinants affecting health inequalities. This study aims to assess the ways that age and gender of the household head and household infrastructure intersect to create relative advantage and disadvantage in COVID-19 vulnerability. Using household primary care survey data from Mamelodi, Gauteng, headed households were sorted into three risk categories for each of the relevant infrastructural determinants of COVID-19. Bivariate ordinal logistic regression was used to determine the odds of households falling into each risk category. The proportion of high-risk (HR) categories and dwelling types was also calculated. Households headed by someone ≥ 65 years were less likely to be in all HR categories and more frequently had formal houses. Male-head households were more likely to be HR for water, sanitation and hygiene infrastructure and indoor pollution; however, female-headed households (FHHs) were at higher risk for crowding. In Mamelodi, households headed by ≥ 65 years olds were relatively infrastructurally protected, likely because of pro-equity housing policy, as were FHHs, except for crowding. The care load on FHHs results in their infrastructural protection benefiting more community members, while simultaneously incurring risk. Infrastructural support based on the household head's age and gender could improve targeting and the effectiveness of health interventions. These results demonstrate the importance of a contextual understanding of gender and age inequalities and tailoring public health support based on this understanding.Contribution:This research describes patterns of health-related infrastructural inequality, identifies ways to improve health interventions, and demonstrates the importance of equity-focused policy in an African context.

Legal Regulation of Cybersecurity and Privacy on the Internet as SDG's

Objective: The article focuses on the conceptual framework for the formation and development of legal regulation of cybersecurity and privacy on the Internet. Theoretical Framework: Technological development has provided humanity with many clear benefits. However, it has also created severe challenges and threats to national security, critical infrastructure, private persons and states, as well as the international community. In Ukraine, these issues have been exacerbated by the Russian-Ukrainian war. Method: The research methodology is based on a logical and systematic presentation and analysis of the material related to the process of legal support for cybersecurity and privacy. Results and Discussion: Today, states and international organizations have to pursue two different policies: one in the virtual environment and the other in the real world. The Presidential Commission on Critical Infrastructure Protection was established in 1996 in the United States. As of today, the definition of “cybersecurity” has been determined at the legislative level. It includes 10 fundamental principles related to the development of the Internet and its impact on human life. Research Implications: The previous legislative experience of international law related to cybersecurity and privacy has been summarized. Originality/Value: In Ukraine, the process of legal support for cybersecurity and privacy on the Internet is also ongoing. Ukraine has both ratified several international documents related to this issue and has its own legislative framework.

Observations on the role of internal sand moisture dynamics in wave-driven dune face erosion

Understanding and predicting dune erosion is crucial for coastal hazards mitigation, ecosystem preservation, as well as the protection of human settlements and infrastructure along sandy coastlines. However, our knowledge regarding the influence and potential importance of internal sand moisture content on wave-driven dune face erosion processes remains limited. This paper presents the findings from an extensive series of controlled wave flume experiments of eroding, unvegetated dunes, combining a range of wave conditions and water levels. A further variable that is studied directly for the first time is the internal moisture content of the dune. The initial moisture content and its evolving dynamics within the eroding dune face are quantified, revealing this to be a determining factor of the observed erosion rates, the final horizontal erosion distance, and the dune face failure type. Importantly, infiltration into the dune with each wave was not a driving mechanism of observed failures, but rather the rapid increase and then decrease of the phreatic surface within the dune, resulting in excess pore pressures and destabilization of the sediment matrix. Based on these observations two distinct mechanisms of shear failure and resulting dune face slumping are identified for unsaturated dunes corresponding to ‘minimum’ and ‘field capacity’ internal moisture content: Type 1 is associated with a circular failure surface in the absence of notching at the base of the dune, while for Type 2, notching is present and the failure surface is vertical. Under fully saturated conditions, the phreatic surface is observed to decouple from the wave runup, with excess water continuously exiting the dune face near the base. This results in rapid shear failure with no notching (Type 3). Significantly, dunes with saturated initial pore moisture content above the capillary fringe are observed to have up to 35 % greater erosion potential, consistently receding further landward than the two unsaturated counterparts as well as undergoing slumping in the absence of wave impact. A new conceptual framework is presented, comprising of a three-phase erosion sequence that directly links dune face failure mechanisms to wave runup and prevailing groundwater conditions.

The future of the Portuguese (SW Europe) most vulnerable coastal areas under climate change – Part II: Future extreme coastal flooding from downscaled bias corrected wave climate projections

Episodic extreme coastal flooding is considered one of the most serious threats to the global coastlines, endangering infrastructure, ecosystems, and communities. The synchronized effects of extreme wave events, storm surges and astronomical tides are particularly worrying in the context of sea level rise (SLR), and a comprehensive understanding of their future dynamics remains challenging. In this study, an innovative approach for a vulnerability assessment of sandy low-lying coastal areas, based on dynamic ensemble projections is proposed. In the current Part II study, the combined effects of future projected SLR, tides, storm surges and wave action are investigated at five key-locations along the Portuguese coastline, considering projected digital terrain models, built upon the shoreline projections obtained in Part I. Future extreme total water levels are obtained through a probabilistic approach, and extreme wave events are defined considering high wave energy thresholds in a changing climate. Overall, extreme coastal flooding is projected across several urbanized sections along the Portuguese coastline, especially in areas without artificial protection infrastructures. Dune erosion is expected along the sandy stretches, reducing the natural protection against extreme coastal events up to 13.3%, and promoting widespread overtopping, leaving populations more exposed. Future projections reveal the episodic flooding of up to 1.47 km2 of land along the 14 km of analyzed coastline, threatening households and commercial hubs, besides services and communication routes. As physical and human losses may increase substantially in the future, our results call for the implementation of adequate coastal management and adaptation plans, strategically defined to withstand changes until 2100 and beyond.

Shoreline barriers may amplify coastal groundwater hazards with sea-level rise

Subsurface barriers have been proposed to protect coastal aquifers from sea-level rise induced seawater intrusion, but the potential for groundwater emergence near subsurface barriers remains unknown. Here, we investigated how emergence changes groundwater flow conditions and influences the protective performance of subsurface barriers with sea-level rise. We tested the subterranean consequences of sea-level rise for cutoff walls and subsurface dams with cross-shore groundwater flow and salt transport models, investigating how barrier design, aquifer properties, and hydrological conditions control the potential for emergence, groundwater partitioning at the barrier, and seawater intrusion with sea-level rise. We find that most subsurface infrastructure cannot prevent seawater intrusion and emergence simultaneously. Subsurface dams spanning more than half of the aquifer thickness created emergence hazards and subsequent groundwater partitioning for all scenarios tested. Cutoff walls were less effective at reducing seawater intrusion for all opening sizes but could reduce the emergence potential compared to similarly sized subsurface dams. Our results demonstrate the challenging trade-offs in mitigating the coastal groundwater hazards of seawater intrusion and emergence with sea-level rise, where groundwater flooding inland of protective infrastructure would require combinations of subsurface impoundments and other mitigation techniques, such as pumping or drains.

The Current Status and Challenges of Cybersecurity Risks

<i>Research Context and Aims</i>: The swift expansion of internet technologies has rendered the digital network essential to contemporary life, highlighting the significance of cybersecurity. Network data not only encompasses personal information management and communication but also pertains to the protection of confidential corporate, governmental, and vital national infrastructures. Consequently, cybersecurity has become a critical issue in current society. Frequent occurrences like privacy violations, data thefts, and national security threats underline the critical need for enhanced network defenses and protective measures. <i>Research Approach</i>: This study examines the state of cybersecurity by assessing pertinent studies across public databases such as PubMed, CNKI, and CrossRef. It compiles and evaluates significant cybersecurity events including data breaches, malware attacks, and phishing, outlining key security challenges faced by networks. The paper also evaluates the current cybersecurity technologies and methods, pinpointing their effectiveness and limitations in addressing network threats. <i>Research Findings</i>: The findings reveal that cyber attackers have refined their methods, employing sophisticated, covert techniques for prolonged periods, which often outpace current defenses. In cases of data breaches, perpetrators frequently utilize precise social engineering or deploy advanced persistent threats (APTs). Additionally, the proliferation of IoT technology has not only obscured the boundaries of cybersecurity but also broadened potential attack vectors. Despite the implementation of security measures like encryption and multi-factor authentication, these can be compromised by managerial or operational oversights. <i>Research Conclusions</i>: With the cybersecurity landscape becoming increasingly challenging, future defenses will likely prioritize the adoption of integrated, proactive strategies. It is crucial to foster the development of smart security solutions, such as leveraging artificial intelligence to detect and respond to anomalies. Furthermore, boosting security awareness among users and ensuring standardized practices are imperative. Ultimately, formulating future cybersecurity policies will require a holistic approach, integrating technological, managerial, legal, and educational initiatives to forge a robust network defense architecture.

MBSE Analysis & Update of U.S. Infrastructure Data Taxonomy (IDT) Using U.S. National Critical Functions (NCFs)

AbstractIn this paper, we will demonstrate the application of Model‐Based Systems Engineering (MBSE) tools and techniques we have used to assist the U.S. Department of Homeland Security (DHS) / Cybersecurity Infrastructure Security Agency (CISA) in analysis of open‐source Infrastructure Data Taxonomy (IDT) data to analyze and contribute to the updates required for their IDT. We will show how we have used Functional Analysis, Logical Structure Taxonomies, and MBSE tools to analyze the IDT alongside the DHS National Critical Functions (NCFs) to recommend and improve these updates for their IDT. We have also proposed updates to the NCFs themselves where obvious improvements could be made. Our future recommendations are to continue this effort as a team of INCOSE Critical Infrastructure Protection and Recovery (CIPR) team members, along with other INCOSE Working Groups (WGs), and to explore other use cases based on this model data, as well as inviting other Subject Matter Experts (SMEs) to assist in the enhancements. This modeling effort demonstrated the use of these MBSE tools while working together with other organizations to enable improvements to the Critical Infrastructure (CI) space leveraging systems theory & thought leadership. We will outline further avenues for exploration using this provided MBSE capability in multiple areas that could be useful to the DHS, and will discuss a potential longer‐term engagement with DHS in an annual challenge. This challenge similar to those led by multiple other projects will include collaborations with universities and other CI / CIPR entities interested in this modeling of the CI space. Other opportunities to extend the model further include, but are not limited to security / cybersecurity, operational, and services modeling use cases, involving Industrial Control Systems (ICS) and much more. We have shown how these tools are effective and efficient for use in the water / wastewater sector, but will also yield similar benefits when applied across all identified sectors and across the international community as well (i.e., transportation, telecommunications, etc.). Interestingly we have seen in our initial analyses that the various taxonomies across sectors, subsectors, segments, subsegments, and assets vary slightly between regions and countries internationally for various reasons.

Innovative solutions for critical infrastructure resilience against cyber-physical attacks

Critical infrastructure must withstand cyber and physical assaults in today's interconnected world. This study explores innovative strategies to shield these systems from cyber-physical threats. As networks become more connected, cyberattacks grow more sophisticated, making it imperative to safeguard sectors like transportation, energy, water, and information. The paper analyzes the present and future threat landscape, identifying vulnerabilities within critical infrastructures and proposing targeted mitigation strategies to enhance security. The research leverages AI and machine learning to develop detection tools that identify and predict cyber-physical attacks, enhancing response times and preventive measures. Additionally, resilience engineering and architecture are crucial in fortifying infrastructure, enabling it to withstand and recover from attacks while maintaining essential functions. The study also reviews legislation and policies surrounding infrastructure protection, pinpointing shortcomings and recommending improvements to bolster national security. Effective countermeasures against cyber-physical threats require collaboration and information sharing among government bodies, industry stakeholders, and educational institutions. These partnerships facilitate the exchange of knowledge, best practices, and tools to address threats efficiently. Furthermore, the paper highlights the importance of training programs that equip professionals with skills to integrate cyber and physical security defenses. Exploring the integration of blockchain, IoT, and autonomous technologies could further enhance the resilience of critical systems. These technologies foster secure communications and automated responses to incidents. Lastly, community awareness initiatives play a vital role in preparing for and mitigating cyber-physical attacks, ensuring that public readiness and resilience are maintained. This comprehensive approach aims to fortify critical infrastructure against evolving cyber threats, ensuring continuous operation and security.

METHODOLOGY FOR IMPROVING THE CYBER THREAT PROTECTION SYSTEM

The article presents the results of a study of the enterprise information security system and the development of proposals for its implementation. The article considers security as a system that includes tools and processes used by organizations to protect information. This includes policy settings that prevent unauthorized persons from accessing business or personal information. Information security is positioned as a growing and developing industry, covering a wide range from network and infrastructure protection to testing and auditing. The article analyzed IT products designed to ensure information security that are used in small and medium-sized businesses, explored problem areas and current applications that entrepreneurs use. One of the most pressing problems in the IT industry today, in the era of big data, is the rapid growth of the volume of unstructured content. Virtually every corporate data center (Docs) has file servers, corporate portals, Microsoft Exchange folders, network and cloud storage locations that contain many documents, including the content of important information. In addition, the repeated increase in volume and the growing variety of information stored and processed significantly complicates the task of managing this data.

A method of using modern endpoint detection and response (EDR) systems to protect against complex attacks

The subject of the research in this article is the architecture of Endpoint Detection and Response and the EDR agent as their base parts in terms of mechanisms for detecting and countering complex attacks on information and communication systems (ICS). The aim of the work is to develop of method for improving the efficiency of using Endpoint Detection and Response (EDR) to reduce the risks of compromising ICS information, industrial, and infrastructure objects by effectively redistributing and utilizing the available EDR mechanisms, the cybersecurity team, and other resources available for implementing security measures in an enterprise, institution, or organization. The article addresses the following tasks: reviewing and analyzing existing EDR systems, analyzing the architecture of EDR solutions and EDR agents, the features of their use, the logic behind the construction of methods and mechanisms for detecting threats to the system from malicious actors and malicious code. The task of providing recommendations for the organization of ICS is also separately addressed in terms of the need to protect the entire ICS and its individual elements, as well as in terms of the available resources (the cybersecurity team, their qualifications and level of awareness of the architecture of EDR solutions) and means (available EDR system elements) for organizing protection. The following methods are used: modeling attack mechanisms, modeling attacker behavior. The following results were obtained: general and specific recommendations were formulated for optimizing the operation of EDR systems and ensuring the effective use of EDR system elements in the information and communication networks of enterprises, organizations, and institutions of various types and orientations depending on the available resources and the information requiring protection. Conclusions: The identified recommendations for the application of EDR mechanisms for protecting information systems and networks allow optimizing the costs of creating a protection infrastructure and implementing security measures, taking into account the characteristics of the available tools and the training and awareness of the cybersecurity team both in terms of response time to threats and the complexity and cost of performing protection tasks.

Training of specialists as one of the aspects of resilience of critical infrastructure

One of the directions of state policy in the field of ensuring national security is the development of a multi-level effective national security and resilience system for critical infrastructure. A key factor in any system, whether in the field of national security or in other spheres, is human capital, its ability to analyze risks and threats, identify vulnerabilities, master newtechnologies, and find innovative solutions to address modern challenges. Thus, an important aspect becomes the training of qualified professionals who possess systemic knowledge and skills. The need to provide systemic knowledge to specialists and managers directly addressing the tasks of ensuring the protection and resilience of critical infrastructure has been established. The current state of the training system for specialists in the field of critical infrastructure protection in Ukraine has been identified, and the main forms of organizing training and personnel preparation in this area have been analyzed. Tasks have been established based on an analysis of existing professions and labor market demand to determine a set of professions that are expedient to involve in ensuring the security and resilience of critical infrastructure. An analysis of the training and qualification enhancement of specialists in the field of critical infrastructure protection and resilience has shown the necessity and possibility of creating a national education and training system on critical infrastructure protection and resilience in Ukraine. Professions and labor market demand have been analyzed, and a set of professions expedient to involve in ensuring the security and resilience of critical infrastructure has been determined. After their final approval, these professions could include: the head of a structural unit responsible for the protection and resilience of critical infrastructure and a specialist in the protection and resilience of critical infrastructure. Developed or updated professional standards in the field of critical infrastructure protection and resilience will serve as a basis for adapting educational programs of higher education institutions according to the labor market demand.

Investigation of associative rule search method for detection of cyber incidents in information management systems and security events using CICIDS2018 test data set

Automated rule generation for cyber incident identification in information management and security event systems (SIEM, SYSTEM, etc.) plays a crucial role in modern cyberspace defense, where data volumes are exponentially increasing, and the complexity and speed of cyber-attacks are constantly rising. This article explores approaches and methods for automating the process of cyber incident identification rule generation to reduce the need for manual work and ensure flexibility in adapting to changes in threat models. The research highlights the need for utilizing modern techniques of Intelligent Data Analysis (IDA) to process large volumes of data and formulate behavior rules for systems and activities in information systems. The conclusion emphasizes the necessity of integrating multiple research directions, including analyzing existing methods and applying IDA algorithms to search for associative rules from large datasets. Key challenges addressed include the complexity of data modeling, the need to adapt to changes in data from dynamic cyber attack landscapes, and the speed of rule generation algorithms for their identification. The issue of the "dimensionality curse" and the identification of cybersecurity event sequences over time, particularly relevant to SIEM, are discussed. The research objective is defined as the analysis and evaluation of various mathematical methods for automated associative rule generation to identify cyber incidents in SIEM. The most effective strategies for enhancing the efficiency of associative rule generation and their adaptation to the dynamic change of the cybersecurity system state are identified to strengthen the protection of information infrastructure.

Система суб’єктів адміністративно-правового забезпечення кібербезпеки

This article analyzes the role of administrative bodies in ensuring cyber security from a legal and administrative perspective. The key functions and tasks they perform for effective management and protection of information resources and cyber infrastructure are considered, as well as the importance of the role of subjects of administrative and legal protection of cyber security in the formation of strategies and policies aimed at ensuring cyber security is highlighted, and their contribution to the creation of a secure and stable cyberspace. Aspects that contribute to a better understanding of the role of state structures in ensuring security in cyberspace and increasing their effectiveness in this direction are considered. The normative legal acts regulating the powers and functions of subjects of administrative and legal protection of cyber security are described, in particular the Law of Ukraine “On the Basics of Cyber Security of Ukraine”, as well as the impact of the administrative and legal protection of cyber security on the effectiveness of the protection of information resources and cyber infrastructure. It is characterized that the system of subjects of administrative and legal support for cyber security is an organic combination with a common goal of state and non-state institutions, as well as other subjects that participate in the implementation of measures aimed at ensuring cyber security. Proposed: development and implementation of relevant legislation; coordination of actions between various subjects, detailed and clear demarcation of the competence of state bodies that are subjects of cyber security; establishment of a mandatory certification system to assess and confirm the level of cyber security for all entities that are critical to infrastructure or national security; cooperation with the private sector and the public; developing cyber incident response plans and recovery programs after they occur to minimize damage and business interruptions.