Threat Information Research Articles

IMPLEMENTATION OF MEDIA LITERACY AS A MEANS OF COUNTERING ENEMY PROPAGANDA

The article reveals the essence and features of media literacy as a way of countering hostile propaganda. The study considered the main components of media literacy and analyzed its main principles. Informational threats in wartime and the peculiarities of propaganda were studied. Specific methods of countering propaganda and information manipulation have been studied.In connection with enemy propaganda, the introduction of media literacy as a means of countering enemy propaganda became very important during the Russian invasion. During the beginning of the invasion of Ukraine, russia has launched hundreds of thousands of fakes to demoralize and sow panic among Ukrainians. That is why today it is important to understand the mechanisms and means of enemy propaganda, to be able to recognize enemy information leaks inside and outside of Ukraine, in order to counteract fakes and manipulations, neutralize and debunk lies. Many media outlets ignore objective facts and use the latest technology and digital equipment to appeal to the emotions of viewers, craft messages and spread misinformation that misinforms people. In addition, russia is making every effort to discredit Ukrainians in the eyes of the international community and destroy social cohesion in the country. Informational aggression can be countered only when the population understands the principles by which events take place and for what purpose and what specific damage they can cause. In order to counteract enemy propaganda, it is necessary to apply critical thinking in order not to fall into the trap of pro-russian media and not to be misinformed. Even in wartime, teachers must not only show positive propaganda, but also bring back to children the knowledge of media and information literacy that they acquired before the war.

The Use of Means of Military Diplomacy in Providing Information Security as a Peacebuilding Factor

The research aims to determine the role of military diplomacy in providing information security as a key factor in building peace through the identification of key measures to counter information threats in the digital environment. The research employed the following methods: content analysis, rating analysis, and survey results processing. As a result of the conducted research, the place of digital diplomacy was determined concerning military diplomacy as a special form of its implementation to provide information security. The security of cyber-physical systems has been proven to be one of the most important approaches to data protection in military diplomacy because, among other things, the security of critical infrastructures depends on it. The research findings can be used by diplomatic service officers to increase the effectiveness of military diplomacy in the digital environment by implementing the proposed measures and directions in their activities.

Information security in the Republic of Moldova in the context of the European integration process

In this article, the author analyze the information security phenomenon of the Republic of Moldova in the context of the European integration process of our country, in the conditions of the war started by Russian Federation in Ukraine. It is highlighted that at the present time, the Republic of Moldova does not have sufficient protection of the public sector and the private sector against incidents, risks and threats related to the security of networks and IT systems, therefore in the context of the obligations assumed by the Republic of Moldova with reference to securing information in the context of the European integration process, a legal basis was created. The author mention that the phenomenon of Russian media propaganda represents one of the main challenges for the information space of the Republic of Moldova. In conclusion, the author emphasize that informational threats threaten the stability, national and political security of the state, and informational aggressions in the chain can constitute an informational war, in which the specialized information services froabroad foreign countries. Ensuring information security requires a joint effort between intelligence services, academic environments and non-governmental organizations. The purpose of the information security strategy of any state is to legally correlate and systematically integrate the priority areas with responsibilities and powers to ensure information security at the national level, intended to protect the sovereignty, independence, territorial integrity of the state.

A Photosensitivity-Enhanced Plant Growth Algorithm for UAV Path Planning.

With the rise and development of autonomy and intelligence technologies, UAVs will have increasingly significant applications in the future. It is very important to solve the problem of low-altitude penetration of UAVs to protect national territorial security. Based on an S-57 electronic chart file, the land, island, and threat information for an actual combat environment is parsed, extracted, and rasterized to construct a marine combat environment for UAV flight simulation. To address the problem of path planning for low-altitude penetration in complex environments, a photosensitivity-enhanced plant growth algorithm (PEPG) is proposed. Based on the plant growth path planning algorithm (PGPP), the proposed algorithm improves upon the light intensity preprocessing and light intensity calculation methods. Moreover, the kinematic constraints of the UAV, such as the turning angle, are also considered. The planned path that meets the safety flight requirements of the UAV is smoother than that of the original algorithm, and the length is reduced by at least 8.2%. Finally, simulation tests are carried out with three common path planning algorithms, namely, A*, RRT, and GA. The results show that the PEPG algorithm is superior to the other three algorithms in terms of the path length and path quality, and the feasibility and safety of the path are verified via the autonomous tracking flight of a UAV.

The Role of Threat Intelligence in Enhancing Cybersecurity Posture

Organizations confront more complex and persistent cyberattacks in the quickly changing cyber threat landscape of today. Through the provision of actionable insights on emerging threats, adversary tactics, and vulnerabilities, cyber threat intelligence (CTI) becomes an increasingly important component in strengthening the cybersecurity posture of organizational networks. The importance of CTI and its useful uses in enhancing cybersecurity defences are examined in this research study. It explores the several kinds of threat intelligence, methods for compiling and evaluating threat information, and proactive steps that businesses may take to make the most of CTI. This study emphasizes the significance of incorporating CTI into cybersecurity plans to more effectively identify, prevent, and respond to cyber attacks through a thorough review of industry practices and case studies. Organizations may improve their defences against cyberattacks and enhance vital assets and data by comprehending the role that CTI plays in cybersecurity.

Utilization and Sharing of Cyber Threat Intelligence Produced by Open-Source Intelligence

Open-source intelligence (OSINT) is crucial for enhancing organizational cybersecurity by proactively identifying and mitigating potential threats using publicly available information. This study, part of the DYNAMO project, explores the production of cyber threat information (CTI) through OSINT, its application in safeguarding against cyber threats, and the necessary elements for secure information exchange between organizations. The authors employed an integrative literature review of various sources, including industry literature, articles, blog posts, studies, and organizational websites, which were then systematically analyzed using content analysis. The research focuses on OSINT tools and techniques emphasizing the need for expertise in discerning relevant data and respecting privacy rights. Human judgment is highlighted as crucial in ethical decision-making despite the significant role of technology in data collection. Platforms like the Malware Information Sharing Platform (MISP) facilitate the sharing of threat information, promoting prevention and identification of cyber-attacks. Ethical considerations, adherence to data protection legislation, and compliance with directives like the revision of the Network and Information Security Directive (NIS2) and artificial intelligence regulations are paramount. In conclusion, OSINT is a valuable tool for cybersecurity, requiring expertise, transparent processes, and a balanced integration of technology and human skills. The ethical dimensions of OSINT and the role of artificial intelligence merit separate in-depth studies.

Attentional Bias of Individuals with Social Anxiety towards Facial and Somatic Emotional Cues in a Holistic Manner.

Attentional bias towards threatening information is a crucial factor contributing to the development and persistence of social anxiety. However, the attentional bias towards threat information and the preferential processing pattern of emotional cues in individuals with social anxiety disorder during integrated facial and physical stimuli processing remain unclear. In this study, we employed a dot-probe paradigm to investigate the attentional bias towards integrated emotions (facial-body) among students with high and low levels of social anxiety (Experiment 1). Experiments 2 and 3 examined the attentional bias of socially anxious individuals when faced with conflicting emotional cues from faces or bodies in relation to integrated emotions. The data revealed that participants both high and low levels of social anxiety participants exhibited accelerated orienting and biased attention towards facial-body emotional processing. When there was inconsistency between emotional cues from faces or bodies and integrated emotions, higher levels of social anxiety were associated with increased vigilance towards threatening faces or bodies. These findings underscore that individuals with social anxiety possess an ability to rapidly capture threatening cues during the processing of facial-body emotional stimuli while also demonstrating a tendency to avoid relying solely on facial cues by compensating through bodily cues for emotion perception.

ЗАХИСТ ДАНИХ В ІНФОРМАЦІЙНІЙ МОДЕЛІ МОДУЛЯ «КАФЕДРА» АВТОМАТИЗОВАНОЇ ІНФОРМАЦІЙНОЇ СИСТЕМИ УНІВЕРСИТЕТУ

This paper presents the results of a study on the creation of an information model of the "Department" module of an automated information system in a higher education institution, which makes it possible to ensure the proper quality of the educational process in a higher education institution. The revolution in personal computing and the spread of the Internet have brought the solution to the problem of automating information processes at the departmental level much closer, but it takes a long time to improve and disseminate technologies that would support the digitalisation of the entire educational process of the department, meeting the requirements and needs of all its participants. At present, due to the technological capabilities and a significant increase in the methodological level of building information systems for higher education institutions, the conditions have already been created to meet these needs within the automated information system of higher education institutions. However, there are still a number of problems to be solved, such as the development of an information model of the "Department" module. The article presents an information model of the module "Department", which reflects the information processes that support the educational process, shows the possibilities of using this model in the information environment of a higher education institution. In the presented model, special attention is paid to the problem of data protection, which has become more acute in recent years and is a general educational issue. According to Ukrainian and foreign researchers, the educational sector is one of the first in terms of information threats. It is noted that data protection should be taken into account through RBAC (Role Base Access Control) roles, whose policy is more flexible. In addition, the "Department" module can be implemented as a web application "Operational Management Unit", which will not only attract the attention of users but also help them to quickly and easily find the necessary information and perform the necessary actions. The presented example clearly demonstrates the effectiveness of the presented model for the tasks of managing the educational process at the level of a department of a higher education institution.

ЗАХИСТ ДАНИХ В ІНФОРМАЦІЙНІЙ МОДЕЛІ МОДУЛЯ «КАФЕДРА» АВТОМАТИЗОВАНОЇ ІНФОРМАЦІЙНОЇ СИСТЕМИ УНІВЕРСИТЕТУ

This paper presents the results of a study on the creation of an information model of the "Department" module of an automated information system in a higher education institution, which makes it possible to ensure the proper quality of the educational process in a higher education institution. The revolution in personal computing and the spread of the Internet have brought the solution to the problem of automating information processes at the departmental level much closer, but it takes a long time to improve and disseminate technologies that would support the digitalisation of the entire educational process of the department, meeting the requirements and needs of all its participants. At present, due to the technological capabilities and a significant increase in the methodological level of building information systems for higher education institutions, the conditions have already been created to meet these needs within the automated information system of higher education institutions. However, there are still a number of problems to be solved, such as the development of an information model of the "Department" module. The article presents an information model of the module "Department", which reflects the information processes that support the educational process, shows the possibilities of using this model in the information environment of a higher education institution. In the presented model, special attention is paid to the problem of data protection, which has become more acute in recent years and is a general educational issue. According to Ukrainian and foreign researchers, the educational sector is one of the first in terms of information threats. It is noted that data protection should be taken into account through RBAC (Role Base Access Control) roles, whose policy is more flexible. In addition, the "Department" module can be implemented as a web application "Operational Management Unit", which will not only attract the attention of users but also help them to quickly and easily find the necessary information and perform the necessary actions. The presented example clearly demonstrates the effectiveness of the presented model for the tasks of managing the educational process at the level of a department of a higher education institution.

Development of a mechanism for information security risk management of transport service provision systems

The object of the study is the process of analysis, assessment, and management of information security risks in transport service provision systems. The problem of applying the information security risk management approach in the activities of transport business entities was investigated. As a result of the application of effective forms, methods, and means of information security risk management based on international standards, a risk management mechanism was developed. The risk assessment process of transport systems has been systematized. This allows business entities in the transport sector to determine ways to prevent and counter information threats and challenges in their activities, both when designing and operating systems for providing transport services. Verification of the devised methodical approach to information security risk management was carried out on an example of the taxi company «Taxifay N». Threats and challenges of the company’s information system were evaluated by an expert method. Based on the results of the analysis of expert risk assessment, it was found that the concordance coefficient (0.86) confirms the high level of agreement of experts’ opinions. As a result, the company’s information security risk management program was developed. The effectiveness of the program was assessed by the efficiency ratio, which was 0.64. This testifies to the effectiveness of the implemented program of measures to manage information security risks. The scope of application may be the activity of business entities that provide transport services to the population, aimed at data storage and processing. The prospect of this study is to expand the list of threats and categories of vulnerabilities depending on the characteristics of the economic activity of various enterprises

A novel threat assessment method for maritime defense integrating improved IT2FBWM, prospect theory and VIKOR under hybrid fuzzy environment

The weaponized unmanned aerial vehicle (UAV) swarms have posed a significant threat to maritime civilian and military installations. For effective defense deployment, threat assessment has become a critical part of maritime defense decision-making. However, due to the uncertainty of threat information and the ignorance of decision-makers’ psychological behaviors, there are great challenges in obtaining a reliable and accurate threat assessment result to assist in maritime defense decision-making. To this end, this paper proposes an integrated threat assessment method for maritime defense against UAV swarms based on improved interval type-2 fuzzy best-worst method (IT2FBWM), prospect theory and VIKOR (VlseKriterijumska Optimizacija I Kompromisno Resenje, in Serbian). Firstly, the improved IT2FBWM is designed by introducing interval type-2 fuzzy set (IT2FS) and entropy-based information to obtain attribute weights with high reliability. Then, the hybrid fuzzy scheme covering IT2FS and interval number is constructed to express the uncertainty of different types of threat information. Next, VIKOR is extended to hybrid fuzzy environment and combined with prospect theory to consider the influence of psychological behaviors of decision-makers. Finally, the improved IT2FBWM and extended VIKOR are integrated to determine the threat ranking of targets and the priority defense targets. A case study of maritime threat assessment is provided to illustrate the performance of the proposed method. Moreover, sensitivity and comparative experiments were conducted, and the results indicate that the proposed method not only obtain the reliable threat assessment result but also outperforms the other methods in terms of attribute weight determination, decision preference consideration and decision mechanism.

Anticipative Urban Warfare Strategies on the Neo'post-Truth Era in Indonesia

Objective: The objective of this research was to explore the Universal People's Security Defense System that has not been well socialized in anticipating future threats. The aim of this research is to realize an anticipatory Urban Warfare strategy by creating a General National Defense Policy for 2025-2030 in the Neo' Post-Truth Era in Indonesia. Method: The qualitative method used in this research is a case study approach. Through literature study data collection and analyzing several rules regarding the urban warfare strategies, the research focused on how these elements mold the future policy on the neo ‘post truth era in Indonesia. Results: The facts about the threats of radicalism, terrorism, insurgency, separatism and social revolution change the arrival of military, non-military and hybrid threats into a new categorization of threats in the form of asymmetric, proxy, hybrid and information threats as urban warfare threats. Various countries have experienced the problem of urban warfare starting from the Arab Spring in the Middle East, African countries, South Asia and Southeast Asia, including Indonesia. The results of this research show, first, the forms of threats in the world and Indonesia in the form of asymmetric, proxy, hybrid and information threats. Second, the policy and implementation are in accordance with the General State Defense Policy in the Neo' Post-Truth Era in Indonesia in the form of a policy of balancing security and prosperity. Third, Anticipatory Strategy for Urban Warfare in the Neo ‘Post-Truth era in Indonesia in the form of intelligence cooperation, diplomacy and operations. The conclusion of this research requires the creation of the latest 2025-2030 jakum hanneg in anticipating Urban Warfare in Indonesia. Conclusion: Urban warfare is complex and challenging. This operation is not only military in nature, but also has many aspects because it must take into account the economic, social and other characteristics of the city. Successful urban operations require specialized strategy and training, as well as adapted weapons and equipment. Implementation policy general national defense can involve development strength reliable military and non -military for capable face threat in environment urban areas, including effective strategies and tactics in face urban warfare. This is possible involve training special for personnel military in urban battle, development appropriate technology and equipment for operation urban, as well good planning and coordination between various units and agencies involved in national defense. Apart from that, implementation policy general national defense can also cover effort to build cooperation with parties related in face threat of urban warfare. This can involve cooperation with police, government region, and society civil in effort for increase security and preparedness in face threat in urban environment.

INFORMATION TERRORISM AND ITS PREVENTION IN THE GLOBAL POLITICAL ENVIRONMENT IN THE 21ST CENTURY

The manifestations of information terrorism can be realized concerning the subjects of the global political sphere. Preventing and countering its consequences is a difficult task, primarily due to the multiple directions of modern threats, as well as the complexity of selecting and implementing measures to be taken to counter such manifestations of information danger. The study aims to analyze the trends in the development of measures to counter information terrorist attacks that have been and are being carried out against the targets of the global political sphere in the XXI century. The research was carried out using the methods of sequential analysis of the peculiarities of development and systemic description of information terrorism. In addition, the article provides a comparative assessment of related concepts. The descriptive method, comparison, analysis and synthesis of information were used to assess the content, methods of counteraction, principles and measures to counter information threats. According to the research results, the key features of countering information terrorism today include the formation and improvement of the regulatory framework based on global cooperation, openness, transparency, increased responsibility and proactive state policy to counter information terrorist attacks.

Informational and legal characteristics of the main components of the state security sector

The article is devoted to the study of the informational and legal characteristics of the main components of the national security sector of the state. It is noted that the category “national security” reflects the qualitative state of the regulation of social relations in the state and emphasizes the fact that the security of the state consists in ensuring national identification. It has been established that the provision of state security is structured through the differentiation of national security by sector-specific (includes: military security, public security, state security, cyber security, foreign policy security, environmental security, information security) and subject characteristics (includes the activities of authorized subjects). The concept of “state security sector” is defined as a set of legal relations, the content of which is the activity of authorized subjects to ensure national security as a whole, and in certain differentiated directions. Amendments to the Law of Ukraine “On National Security” are proposed.
 Attention is focused on the fact that the information and legal characteristics of the state security sector are an integral component of the national security of the state as a whole and its individual components. The importance of eliminating information threats has institutionalized a separate area of state security - information security. It was established that cyber security is an independent component of state security derived from information security, which emerged as a result of the development of digital technologies and the spread of the use of information and telecommunication systems for the purposes of information dissemination.
 The institutional system of ensuring information security is singled out, which is formed from a set of authorized subjects, which are grouped depending on their legal status and available powers in the field of information security as follows: 1) state bodies authorized to ensure national security; 2) bodies of executive power, which are empowered in the specified sphere of public relations; 3) law enforcement agencies; 4) auxiliary entities that can carry out separate activities aimed at ensuring information security.

Machine Learning Applications in Cyber Threat Intelligence: A Comprehensive Review

Contemporary institutions are consistently confronted with fraudulent activities that exploit weaknesses in interconnected systems. Securing critical data against unauthorized access by hackers and other cybercriminals requires the application of robust cybersecurity protocols. As the number and complexity of cyber threats continue to grow, innovative prevention strategies are required. The objective of this study is to investigate the correlation between machine learning (ML) and cyber threat intelligence (CTI) to improve cybersecurity strategies. For the detection of anomalies, the analysis of malware, and the prediction of threats, ML techniques are indispensable in industries including retail, finance, healthcare, and cybersecurity. By employing critical threat information (CTI), security teams can gain a comprehensive understanding of adversary strategies and bolster defensive measures; thus, they play a pivotal role in proactive defense. Integration of ML and CTI facilitates exhaustive analysis by automating the acquisition, processing, and categorization of data. However, obstacles arise when confronted with issues such as risk assessment, the requirement for precise data, and the initial stages of machine learning implementation in business intelligence. In this paper, we present an extensive examination of the current literature concerning the visualization of Cyber Threat Intelligence (CTI) and the utilization of Machine Learning (ML. Therefore, the report concludes with an analysis of emergent threats, potential future applications of AI and ML in the field of cyber threat intelligence, and the critical contribution of machine learning to the improvement of cybersecurity.

The association between looming cognitive style and posttraumatic stress symptoms: The case of older Holocaust survivors

The looming cognitive style (LCS) refers to a tendency to produce mental illustrations and images of adverse events and potentially threatening situations with perceived accumulating threat and danger. LCS is a well-known cognitive vulnerability for anxiety, nevertheless few studies examined the relationship between LCS and posttraumatic reactions. Among the existing studies, a higher LCS was reported in Holocaust survivors relative to matched comparisons, and directly associated with posttraumatic stress symptoms (PTSS) in older Holocaust survivors. The current study aimed to expand the understanding of the relationship between LCS with PTSS in general, and among older Holocaust survivors in particular. Moreover, whether the number of Holocaust experiences encountered by Holocaust survivors moderated this relationship. The sample consisted of 153 older Holocaust survivors (Mage = 82.42, SD = 5.75). Participants were interviewed regarding their background characteristics, PTSS, LCS, and number of Holocaust experiences. Participants reporting higher LCS showed higher PTSS. There was an interaction between LCS and number of Holocaust experiences for predicting PTSS, suggesting that LCS was associated with higher PTSS to a stronger degree among Holocaust survivors who experienced a smaller number of Holocaust experiences. The findings indicate that Holocaust trauma may have influenced the LCS of Holocaust survivors throughout their lives and into old age. The results provide insight for mental health practitioners treating older Holocaust survivors in focusing on reducing schematic processing biases for threat information and anxiety to enhance better mental health for those suffering from posttraumatic stress symptoms.

METHODOLOGY FOR ASSESSING THE IMPACT OF INFORMATION THREATS IN THE CONDITIONS OF INFORMATION CONFRONTATION

The problem of information confrontation as rivalry in the information sphere with the aim of influencing various aspects of social relations is extremely important in the period of hybrid war. The object of the study was to the models of the dissemination of information and models of information confrontation. The goal of the work is the determine the features of the dissemination of informational threats in the conditions of informational and psychological conflict using a mathematical model based on modern achievements of social psychology, and to find optimal modes of informational dissemination and means of neutralizing informational threats. Mathematical models are proposed that describe the processes of the dissemination of informational threats in the conditions of informational and psychological conflict based on the innovation diffusion model and rivalry models. It is assumed that two flows of information dissemination in society so that each individual can become a supporter of one or the other side. The peculiarities of the methods of choosing behavioral strategies by subjects of influence in the social network during information confrontations are analyzed. The conditions under which one of the parties to the conflict can achieve an advantage by systematically varying the characteristics of the process have been studied. Based on the analysis of mathematical models of the dissemination of information threats, meaningful characteristics are defined, the management of which will reduce or neutralize the impact of the flow of negative information. The presented mathematical models allow to make for both quantitative and qualitative analysis of the main characteristics of the dynamics of information confrontation. The prospects for further research may consist in the generalization of the proposed models for a larger number of information flows and taking into account the dynamics of changes over time in the intensity of information dissemination and other characteristics.

Правові операції у глобальному контексті

Background. The emergence of the concept of warfare, defined as the use of law to wage war, has prompted a reassessment of the strength of the international order based on the rule of law. Similar to the regulation of cyberspace, information threats, and instruments of economic and financial pressure, warfare is a non-kinetic action that does not follow the traditional course of an armed attack. Caught off guard, states do not know how to respond to these non-kinetic actions as they take place in a new and rapidly changing regulatory environment. Methods. The source base of the study is formed by documents of international organizations and scientific publications on legal operations. The author uses the dialectical, historical, comparative legal methods to track the transformation of views on the processes of planning and conducting legal operations; systemic and structural, formal and logical methods to determine the provisions which should be taken into account in the process of introducing the concepts of legal operations into the activities of the Armed Forces of Ukraine; and methods of analysis, generalization and synthesis to develop relevant proposals. Results. International official documents (agreements, protocols, conventions, recommendations, standards, declarations, communiqués, messages, charters) that regulate and govern the issue of hybrid warfare were summarized and systematized; Proposals for the implementation of legal operations concepts in Ukraine were developed. Conclusions. The results of this study develop the ideas of other researchers on the expediency of introducing the concept and implementation of legal operations in the context of hybrid warfare.

Securing the Digital Commerce Spectrum and Cyber Security Strategies for Web, E-commerce, M-commerce, and E-mail Security

Secure protection of sensitive data and financial transactions is of the utmost importance in the dynamic world of online trade. In this study, we present a full-stack security architecture that uses five separate algorithms: ECF, Transaction Anomaly Detection, Adaptive Threat Intelligence, Behavioral Biometric Authentication, and Dynamic Encryption Protocol. By creating encryption keys on the fly while the user logs in, the DEP method lays a solid groundwork for safe data transfer. Behavioral biometric authentication (BBA) uses DEP output to verify users based on their distinct behavior, which is an extra layer of security. By combining both current and past threat information, the ATI algorithm is able to constantly adjust security protocols, providing a preventative shield against new dangers. TAD is an expert at detecting anomalies in online purchases, which helps keep financial transactions honest. When ECF and DEP work together, they filter email content, making communication more secure. Flowcharts help to illustrate the interactions between various algorithms, which helps to understand their operations in detail. Every algorithm's importance is brought to light by an ablation study, which shows how each one contributes and how they all work together to affect the overall security posture. The suggested security framework outperforms the state-of-the-art in terms of efficacy, adaptability, and usability, according to performance evaluations conducted using a number of metrics. These findings can help decision-makers build a strong security plan that is specific to the challenges of online shopping. To conclude, the suggested framework is an integrated and complementary strategy that will strengthen online trade in the face of several cyber dangers while simultaneously protecting the confidentiality, authenticity, and availability of all associated communications and transactions.

MATHEMATICAL METHODS IN CYBER SECURITY: CLUSTER ANALYSIS AND ITS APPLICATION IN INFORMATION AND CYBERNETIC SECURITY

The huge number of information threats and their complexity prompts research and modeling of new methodologies and information protection systems. The development and improvement of information and cyber security systems includes the creation and processing of mathematical models using information technologies. This article is a follow-up study on the application of mathematical methods and technologies in cyber security, namely: methods of cluster analysis. The modern development of computer technology and the growth of their power have contributed to the wide implementation of Data Mining algorithms for processing large volumes of information in various fields of society and science, in particular in the field of cyber security. Cluster analysis allows the set to be divided into subsets, so that the elements of each subset are similar to each other, and the elements of different subsets are the most different. This provides an opportunity to eliminate the shortcomings of the qualitative approach in assessing information risks. The paper reviews scientific sources regarding the applied aspect of the application of clustering methods in security systems, because timely forecasting of possible incidents allows you to manage information risks and make effective decisions to ensure confidentiality, availability and integrity of information. The stages of the clustering procedure are characterized, the issues of choosing the distance measure and the similarity measure for the objects under study are highlighted. The comparative characteristics of the most popular methods of cluster analysis are presented: the “nearest neighbor” algorithm, “k-means”, “fuzzy c-means”, “cosine similarity”, their advantages and disadvantages are defined. This study can be useful and used in the educational process of students of the specialty 125 “Cyber security and information protection”.