Information systems and technologies security
Київський національний університет імені Тараса Шевченка
Methods for determining the equilibrium state of a network with given flows in nodes of information networks of cyber-physical systems
Background. The multidimensionality of cyberspace and the high level of informatization of critical infrastructure objects, both in Ukraine and globally, pose a threat to humanity at the global level in the foreseeable future. The situation is complicated by the fact that critical infrastructure objects, which operate within a unified information space and support a wide range of modern information technologies, remain vulnerable to new types of threats, despite tremendous efforts to counteract external cyber intrusions. Methods. It has been identified that the study of complex systems employs modern mathematical methods such as topology, graph theory, and linear algebra. Results. The entropic method for analyzing complex systems has found wide application in practical problems related to the study of natural, technical, and cyber-physical systems. This method has long been used to develop efficient systems for coding, encryption, and information protection. With the increase in computational power, the practical value of researching dynamic systems – including those based on entropy – has grown, as entropy serves as a good indicator for selecting certain states of a system from the set of all its possible states. Conclusions. Since the study of structures and general patterns is common across many branches of science and technology, tasks of a general nature – where the specific nature of the system is not taken into account – remain relevant. This study presents an algorithm for determining the state of a multi-node information flow network in which its entropy reaches a maximum value. The algorithm is based on analytical expressions for entropy and its first and second derivatives, derived by the authors and defined on the set of kernel solutions of a system of linear equations to which the original problem is reduced. Experimental results are presented for determining the solution set and solving the optimization problem of finding the state with the maximum entropy value for networks with 3, 4, 5, and 6 nodes. Possibilities for further improvement of the method for calculating more complex networks are analyzed.
Copyright (c) 2025 Information systems and technologies security https://creativecommons.org/licenses/by/4.0
Fast fourier transform in ofdm: algorithmic approaches and their role in information technologies
Background. Orthogonal Frequency Division Multiplexing (OFDM) is a key technology in modern information systems and is widely used in mobile networks such as 4G and 5G, the IEEE 802.11 standard (Wi-Fi), and digital television (DVB-T). The increase in the communication channel bandwidth requires an optimal selection of signal transformation parameters for efficient use of the hardware resources of Field-Programmable Gate Arrays (FPGA) in the implementation of OFDM. Methods. The following methods were used: modeling of an OFDM-based communication system in the Simulink environment, which allowed for the study of signal processing transformations, as well as the analysis of the bit error rate (BER) for different modulation parameters. The implementation of FFT algorithms was carried out using HDL coding to compare the efficiency of the Fast Fourier Transform (FFT) algorithms Streaming Radix-2² and Burst Radix-2. Results. Simulation results showed that using signal resampling at the transmitter improves the channel energy efficiency, reducing the required power level by 12 dB. The relationship between the bit error rate and the signal-to-noise ratio (SNR) demonstrates that increasing the FFT length from 512 to 2048 points requires a 6 dB increase in the SNR. The analysis of the cyclic prefix (CP) impact showed that the optimal CP length is 1/16 of the OFDM symbol, which reduces transmission speed losses. The effect of modulation on the bit error rate (BER) indicates the need for increased power when transitioning to higher-order Quadrature Amplitude Modulation (QAM). Conclusions. It was concluded that the parameters of FFT and signal resampling are critical for the efficiency of the OFDM system. The results obtained can be used to optimize the implementation of OFDM on FPGA.
Orthogonal Frequency Division Multiplexing (OFDM)
Spam detection in text messages using logistic regression based on gradient descent
Background. With the increasing volume of email communication, the problem of spam filtering is becoming more and more relevant. According to statistical research, spam constitutes a significant portion of global email traffic, creating risks both for security and for the efficiency of electronic communication. In this context, natural language processing (NLP) and machine learning methods are gaining particular importance. The aim of this study is to develop a model for classifying email messages into spam and non-spam using logistic regression implemented via gradient descent, in combination with text data processing methods. Methods. The model was trained on a dataset containing over 5,000 email messages labeled as spam or non-spam. The data were preprocessed by removing noise components such as punctuation, numbers, stop words, and short tokens, followed by lemmatization. The cleaned texts were converted into numerical format using TF-IDF vectorization with L2 normalization. To address the class imbalance, the SMOTE method was applied. The model was trained using a classical gradient descent scheme with a sigmoid activation function and a logarithmic loss function. Results. The resulting model achieved high performance on the test set: overall accuracy was 98%, with an F1-score of 0.92 for the spam class and 0.99 for the non-spam class. The recall for spam reached 0.90, indicating the model's ability to detect most unwanted messages without excessive false positives. The balance between precision and recall is also reflected in macro and weighted average F1-scores, both exceeding 0.96. Conclusions. The findings demonstrate the effectiveness of combining logistic regression, gradient descent, and text preprocessing for the spam classification task, even in the presence of imbalanced data. The proposed approach is both efficient and interpretable, making it suitable for practical implementation in email filtering systems.
Implementation of web application security on node.js: main threats and security methods
Background. The intensive development of web technologies and the growing popularity of web applications developed on the Node.js platform open new opportunities for digital business while simultaneously increasing cyber threat risks. One of the key problems of modern cybersecurity is protecting such systems from unauthorized access, data integrity violations, and ensuring their stable operation. In the context of increasing attacks on web resources, security measures that can be integrated without significant performance degradation become particularly relevant. The application of multi-level mechanisms, including access control, input validation, and database query parameterization, forms the foundation of the modern approach to secure development. Methods. This work conducted a systematic analysis of modern methods for ensuring web application security, particularly in the Node.js context. Methods of theoretical modeling, comparative analysis, practical testing of security systems, and effectiveness analysis of various strategies were used. Special attention was paid to the integration of protection mechanisms such as rate limiting, parameterized SQL query processing, user input filtering, and application of the principle of least privilege. For each method, the level of performance load, attack detection accuracy, and compatibility with Node.js architecture were evaluated. Results. The analysis showed that the most effective approach to web application protection is combining several complementary strategies. For example, using parameterized queries significantly reduces the risk of SQL injections, while access control to critical resources prevents unauthorized data modification. It was proven that combining rate limiting and input filtering significantly increases application resistance to brute force and script injection attacks. At the same time, such measures do not create substantial system load, allowing their implementation in real-world conditions. Optimal configurations of protective mechanisms were determined depending on the threat level and functional requirements of the web application. Conclusions. Protecting web applications built on Node.js requires a systematic and comprehensive approach. Combining several protection methods allows achieving a high level of security without reducing application efficiency. The research results can be used to build integrated systems for detecting and preventing cyber threats, taking into account the architectural features of Node.js. Beyond technical aspects, the importance of implementing security policies that encompass both technological and organizational protection components is emphasized. Systematic implementation of such approaches will ensure application resilience even under conditions of increasing cyber threat complexity.
Cybersecurity and information protection
Mathematical model of steganography using suboptimal decisions in data compression algorithms
Background. Protecting access to information in the digital age requires the development of digital tools to encrypt and hide the information from everyone who is not meant to be able to access it. While encryption is great at preventing unauthorized people from accessing the information, it lets people know that there is something hidden behind the transformation. Steganography instead allows us to obscure the fact of information concealment in the first place. Unfortunately, common types of steganography rely on altering the source signal, leaving subtle footprints of data manipulation that can be traced and detected. The goal of this research paper is to provide a model that has the potential of preserving the source signal in its entirety, instead relying on changing the way the source signal is represented in digital media in a way that allows us to encode secret data into the output stream. Methods. A theoretical analysis of steganography approaches on data compression algorithms was conducted. Methods of preserving source data stream were investigated. Results. A new model has been developed that uses decision-making processes in data compression algorithms to encode steganographic data in a resulting data stream. In lossless data compression schemes, it is possible to achieve perfect reproduction of source data stream, making detection through analysis of underlying signal encoded in data compression algorithms useless. Conclusions. The need for information security has been increasing over time, with tensions between countries resulting in new armed conflicts around the world. The ability to embed and covertly send data through steganography may provide a competitive economic, political, and/or military edge. The developed model can be applied to further develop specific methods of steganographic data encoding that is resilient to analysis and detection by existing approaches that rely on statistical analysis of underlying signal stream.
The use of artificial intelligence for ensuring the security of data centers
Background. In today's world, cyber threats to data centers (DCs) have become a significant concern due to their growing complexity and adaptability. Artificial Intelligence (AI) can greatly enhance monitoring and security processes, ensuring real-time threat detection and response. The aim of this study was to evaluate the effectiveness of AI methods for improving DC security and to demonstrate their practical applications. Methods. In today's world, cyber threats to data centers (DCs) have become a significant concern due to their growing complexity and adaptability. Artificial Intelligence (AI) can greatly enhance monitoring and security processes, ensuring real-time threat detection and response. The aim of this study was to evaluate the effectiveness of AI methods for improving DC security and to demonstrate their practical applications. Results. The use of the behavioral anomaly analysis method achieved an accuracy of 89% in detecting suspicious activities, while deep neural networks demonstrated up to 92% accuracy in predicting new threats. The average response time to potential attacks was reduced from 25 to 8 seconds, enabling timely blocking of suspicious actions. Practical applications include integrating these models into monitoring systems, allowing automatic threat detection and mitigation, reducing reliance on human intervention, and minimizing false positives. Conclusions. The study confirmed the effectiveness of AI as a tool for ensuring high levels of DC cybersecurity. AI enables quick and precise threat detection, preventing their realization and minimizing potential damage. However, to fully harness AI's potential, it is essential to consider the need for high-quality training data, computational resources, and algorithm transparency. Future research should focus on refining models to enhance their resistance to manipulation and adaptability to new types of threats.
Hybrid approach to information security risk management
Background. The article explores a hybrid approach to information security risk management that combines quantitative and qualitative risk assessment methods. This approach improves accuracy, reduces subjective judgments, and enables the automation of the risk management process. The relevance of the topic is driven by the continuous increase in the number and complexity of cyber threats, which require the development and implementation of effective tools for risk management and mitigation of human factor impact. Methods. An integrated approach was applied, based on the FAIR and Monte Carlo methods for quantitative probability assessment, and CRAMM for qualitative risk analysis. International standards ISO 31000 and ISO/IEC 27005, which regulate risk management, were taken into account. Asset identification, vulnerability assessment, and threat classification were carried out according to the best practices of information security. The methodology for developing a risk assessment model that considers various levels of potential threats was substantiated. Results. The results confirmed the adequacy and effectiveness of the hybrid approach. The proposed model allowed for the identification of critical assets, risk level assessment, and the development of recommendations for implementing countermeasures. The Monte Carlo method was used to estimate the probability of successful attacks and calculate potential losses. CRAMM analysis helped identify system vulnerabilities and propose appropriate security measures. A comparative analysis of traditional risk assessment methods showed the advantages of the integrated approach in a dynamic information environment. Conclusions. The proposed hybrid approach contributes to minimizing human factor influence, improving assessment accuracy, and automating risk management. This will optimize organizational resources and support strategic information protection planning. Further research may focus on developing automation tools to integrate the proposed approach into real information systems. It is recommended to continue developing the methodology to adapt it to different threat scenarios within organizations with diverse security profiles.
Methods for detection and analysis of misconfiguration-based attacks in cloud services
Background. With the advancement of cloud technologies, an increasing number of organizations are transitioning to the use of cloud services for data storage and computations. However, incorrect configuration (misconfiguration) of cloud services has become one of the main causes of vulnerabilities that can be exploited by malicious actors to carry out attacks. Misconfigurations can lead to unauthorized access to confidential data, system compromises, and other serious security consequences. The aim of this work is to investigate methods for detecting and analyzing attacks arising from misconfigurations in cloud services, as well as to develop recommendations for enhancing security levels. Methods. The study analyzes existing approaches to detecting misconfigurations, including the use of automated scanning tools, analysis of event logs, and the application of machine learning methods for anomaly detection. A hybrid method is proposed that combines static configuration analysis with dynamic monitoring of network traffic. A specialized algorithm has been developed to identify potential vulnerabilities and assess their criticality. Simulations of various types of attacks were conducted to evaluate the effectiveness of the proposed method. Results. The research results showed that the proposed hybrid method allows for highly effective detection of misconfigurations that can lead to attacks. Using the hybrid method increased the accuracy of anomaly detection by 23% compared to traditional methods. Analysis of real attack cases confirmed the method's effectiveness in detecting and preventing threats. The developed recommendations for configuration adjustments help reduce the risk of successful misconfiguration-based attacks. Conclusions. The proposed methods for detecting and analyzing misconfiguration-based attacks in cloud services demonstrated high effectiveness and can be integrated into organizations' security systems. They enable timely identification of vulnerabilities, prevention of potential attacks, and enhancement of the overall security level of cloud infrastructures. Further development of these methods, particularly the improvement of machine learning algorithms, will contribute to more effective protection against new types of threats.
Quantitative risk assessment using the fuzzy sets method
Background. This paper presents a quantitative risk assessment method based on the analysis and evaluation of risks in information systems. The proposed approach enables the use of a wide range of parameters, providing the creation of flexible assessment tools. This method allows calculating risks based on both statistical data and expert evaluations conducted under conditions of uncertainty and poorly formalized environments. Additionally, the developed methods provide the representation of results in both numerical and verbal forms. For example, linguistic variables, which are often used to describe complex systems characterized by both quantitative and qualitative parameters, can be utilized. The risks of information systems can be described through a conceptual fuzzy set model that accounts for uncertainty, imprecision, and subjectivity in their evaluation. Methods. The fuzzy sets method was applied to study the risks of information systems. This method facilitates the prediction of potential economic losses. The proposed approach allows the integration of various risk factors into a unified model, considering both quantitative and qualitative aspects of their assessment. Result. During the study, a quantitative approach to assessing the risks of enterprise information systems was developed, enabling a comprehensive analysis and evaluation of the impact of various risk factors. The main results of the work include: The model accounts for uncertainty, imprecision, and subjectivity of data, which is especially important in unstable environments. This ensures high adaptability of the method to different areas of enterprise activity. The proposed methodology enables the quantitative assessment of potential losses associated with risks in information systems based on statistical and expert data. Based on the risk assessment results, recommendations can be developed to improve measures for protecting the enterprise's information assets. This includes the creation of adaptive protection strategies aimed at reducing economic losses. Conclusions. The use of the fuzzy sets method for quantitative risk assessment of information systems has proven its effectiveness due to its ability to account for uncertainty and subjectivity in data evaluation. The developed approach not only predicts risks but also supports informed decision-making to reduce potential losses, contributing significantly to the development of enterprise information security management systems.
Social media automated account (bot) detection system architecture
Background. Social networks are one of the main sources of information. However, as trust in them grows, so does the use of automated accounts to spread disinformation and influence public opinion, which is an effective method of manipulation. Automated account detection systems are used to detect such accounts. The purpose of the article is to analyze the architecture of automated account (bot) detection systems in social networks and to identify the main directions for improving such architecture, taking into account the identified shortcomings. Methods. Methods of analysis, systematization, and generalization were used to identify shortcomings and areas for system improvement, and a modeling method was used to develop generalized and improved system architecture. Results. An improved architecture of a system for detecting automated accounts (bots) in the social network x.com is proposed, which uses a mixed model of data analysis using artificial intelligence and combines web scraping and API queries for data collection. Conclusions. The general architecture of automated account (bot) detection systems in social networks was analyzed and the main shortcomings and areas for improvement were identified, among which the following can be distinguished: restrictions on API requests from social network owners, unstructured and free style of posts in social networks, and constant changes in post generation algorithms by automated accounts. An improved architecture of the automated account (bot) detection system was proposed, which combines web scraping and API requests for data collection and allows parallel execution of social network data analysis. Keywords: сomputer system, data collection, data analysis, machine learning.
CLUSTRER STATE COORDINATION REDUCERS BASED ON RSDP
Background. Contemporary distributed systems tend to leverage complex network topologies and intercommunication technologies for performing complex computational tasks. It is quite common for such systems to rely on centralized coordination where one or a group of designated servers serve as a management plane for the entire network. While this approach may simplify the consensus process, it introduces additional requirements for infrastructure engineering and maintenance. Nodes serving as a control plane require additional hardware resources as well as human effort and competence to manage external services capable of providing basic coordination primitives. Most cases requiring consensus could be reduced to simplistic procedures like gathering knowledge about network participants and dividing deterministically state slices between them. Therefore, implementing a complex coordination solution that requires an additional maintenance method could be inefficient. The Replica State Discovery Protocol stands as a lightweight coordination solution presenting a simple interface for achieving consensus between nodes within a cluster. Methods. Within the ambit of this research, a set of cluster state reducers is described, providing basic coordination capabilities, including the formation of a network participants list and task division between them. Using mathematical modeling, we describe the procedures necessary for performing the said coordination tasks. Implementation and testing of reducers is done with the Node.js platform capable of running JavaScript code on the server side. A theoretical analysis and description of the proposed methods for distributed coordination are provided within this work to facilitate their integration into modern systems. Results. As a result of this research, we propose three new cluster state reducers serving as methods of basic coordination capabilities as an exemplary application of RSDP. The first reducer is responsible for gathering the directory of participating nodes within a cluster and maintaining their statuses based on the received data. The second reducer performs a timeframe division within a cluster between the nodes to coordinate their execution in a mutually exclusive environment. Lastly, the rate limit reducer describes a logic to perform consensus regarding a single value that should be shared throughout the system as well as promptly updated if needed. Conclusions. While engineering a complex distributed system requiring consensus among its subsystems or a set of homogenous components, it's important to avoid complexities related to the management of additional infrastructure while still providing a required level of consistency and availability. Having said that, the Replica State Discovery Protocol provides essential lightweight capabilities to resolve the said problem through the means of its flexible state reducers system. RSDP is built with a layered architecture in mind, capable of adjusting to the particular needs of the network as shown in this paper. By leveraging existing communication infrastructure and avoiding redundant management layers, RSDP allows for significantly reducing the computational complexity of coordination as well as costs associated with hardware needed for running a dedicated control plane. State reducers described within this article provide basic capabilities required for the most common coordination tasks, including the construction of a participants directory, task splitting and assignments, as well as consensus regarding the configuration parameters.
A method for modeling hybrid influence on government services using an agent-Based Approach
Background. In the context of hybrid warfare, the role of information influence on critical infrastructure is growing. Fake news can trigger waves of user behavioral activity that mimic DDoS attacks, overloading government digital services even without direct technical interference. This creates the need to model such scenarios considering both technical and socio-behavioral factors. Methods. An agent-based model of hybrid influence is proposed, including users, bots, fake news sources, and protective mechanisms. The model is implemented using mathematical expressions and scenario simulation, including a baseline scenario, delayed response scenario, technical intervention scenario, and official rebuttal scenario. The analysis considers system load parameters, behavioral activation probability, and the system's response. Results. It was found that user behavior alone can generate critical system load equivalent to a DDoS attack. The most effective scenario combined technical blocking and information rebuttal, reducing load to a stable level. Classic cybersecurity models often fail to account for delayed reactions or wave-like behavioral patterns, limiting their effectiveness in hybrid environments. Conclusions. The proposed model enables not only simulation of hybrid influence but also evaluation of response tactics. It can be applied in CERT platforms, Red Team / Blue Team exercises, and early-warning systems. Further research may focus on adapting the model to real-world environments and developing automated response mechanisms to information threats.
MATHEMATICAL MODEL OF THE SIGNAL EMISSION DYNAMICS IN SEISMIC-ACOUSTIC MONITORING SYSTEMS OF BUILDING STRUCTURES
B a c k g r o u n d . The paper presents a mathematical model of automated systems of seismoacoustic monitoring of building structures to assess the dynamics of crack formation in building structures to prevent the destruction of the objects under investigation. The seismoacoustic field generated by the research objects is reflected in the matrix of informative parameters, the dynamics of which characterize the dynamics of the object's state. To assess the dynamics of high-frequency signals generated by cracks that occur during the operation of the structure, it is advisable to use the dynamics of emissions that generate these signals. For this, from the point of view of physical practicality, it makes sense to choose a model that characterizes the dynamics of the high-frequency range of the spectrum. Namely, the work presents an algorithm based on a theorem for stationary processes in a broad sense. M e t h o d s . The aging process can be reflected in the feature space, which can be reduced to parameters characterizing the elastic properties of the materials that form the objects under study. Since the propagation velocities and the shape of longitudinal and transverse waves in the material depend on the elastic parameters of these materials (Poisson's ratio and Young's modulus), the change in these parameters leads to changes in the spectral characteristics of the emission signals that occur in the aging material. Any redistribution of energy in the material is accompanied by the appearance of signals that generate emission. The dynamics of the parameters of the emission signal reflect the change in the elastic properties of the object under study. Possible reasons for changes in the internal structure are the appearance and growth of cracks, phase transitions in monolithic materials, and loosening of components. This means that changes in the dynamic parameters of emission signals are related to the dynamic characteristics of this object. R e s u l t s . A mathematical model of building structure aging is proposed. This model of aging of the object must consider the nature of external influences on the object and the nature of its reaction to external disturbances. Given stochastic background noise during monitoring, only the statistical nature of this dependence should be accepted in the model. This model is implemented in building № 3 (cell) of the Kyiv Pechersk Lavra. C o n c l u s i o n s . Two stages of the study of the emission dynamics of building № 3 of the Kyiv Pechersk Lavra showed that during the given time interval, the change in the emission characteristics of this object is within the measurement error. Thus, for an adequate assessment of the emission dynamics generated by cracks that arise during the KPL hull No. 3 operation, it is necessary to collect statistics over a time interval of several decades. To solve this problem, it is essential to carry out permanent seismoacoustic monitoring of the building structure.
matrix of informative parameters of the model
B a c k g r o u n d . Cyber-Physical Systems (CPS) play an important role in today's technology, as they combine physical objects and cryptographic security mechanisms to ensure the secure operation of networked devices, particularly in the financial industry, the Internet of Things (IoT), and the Industrial Internet of Things (IIoT). The main problem of such systems is to ensure reliable and effective data protection with limited resources of computing power and energy consumption. Cryptographic protocols used in cyber-physical systems must be highly efficient, because both the security and the overall performance of the systems depend on their operation. This article is aimed at researching ways to improve the efficiency of cryptographic protocols in KFS. R e s u l t s . During the research, it was established that: the use of MTLS protocols increases the level of data protection, but at the same time requires a much larger amount of CFS resources compared to TLS and SSL. At the same time, TLS still uses more capacity of cyber-physical systems than SSL, which increases the cost of CFS devices. Optimizing encryption and decryption algorithms in the TLS protocol can help reduce device costs and increase data transfer speeds. C o n c l u s i o n s The obtained results show that increasing the efficiency of cryptographic protocols in cyber-physical systems is possible by using more effective encryption algorithms. Optimizing security protocols can significantly improve the data transfer rate and performance of cyber-physical systems, especially in resource-constrained environments. It is worth paying attention to the concept of using existing security protocols that combine the use of symmetric and asymmetric encryption algorithms. In the future, it is the speed of encryption and decryption that will play a significant role in increasing efficiency. Since it is this factor that will reduce the use of resources in the CFS and will also gain an advantage in time, due to the transfer of more information per unit of time, with almost no loss in crypto-resistance. Further research may focus on the development.
SECURITY OF REST API: THREATS AND PROTECTION METHODS
B a c k g r o u n d . The increase in malicious activity in the information space creates additional challenges for organizations that use REST APIs to transfer data and facilitate interactions with clients and partners. According to statistics, over 80% of modern web traffic goes through web APIs, making them an attractive target for cybercriminals. Vulnerabilities in REST API authentication and authorization mechanisms can lead to data breaches, financial losses, and reputational risks. Therefore, ensuring REST API security is a critical task for modern companies, especially those operating in high-risk industries. M e t h o d s . Threat analysis and risk assessment methods were used to evaluate the security challenges associated with REST APIs. R e s u l t s . Organizations are investing significant resources in the development of REST API security technologies, implementing tokens for access control, encrypting data transmission via TLS/SSL, and integrating modern security measures into their applications. However, research shows that major security threats remain relevant due to insufficient input validation processes, weak passwords, and the lack of multi- factor authentication. It was also found that a significant number of APIs lack rate limiting, making them vulnerable to resource exhaustion attacks (DoS/DDoS attacks). С o n c l u s i o n s . One of the key approaches to addressing REST API security issues is the implementation of an API security management system that uses a multi-layered approach to protection. This includes access control, token-based authorization, regular system vulnerability checks, and rate limiting to reduce the risk of denial-of-service attacks. In addition, implementing modern security practices, such as multi-factor authentication, will help minimize the risk of unauthorized access. The research findings can be used to improve existing REST API security policies and optimize threat management approaches in companies of various sizes.
AUTHORIZATION MODELS FOR TRUSTLESS NODE INTERACTION IN PUBLIC DECENTRALIZED NETWORKS
B a c k g r o u n d . Decentralized networks, such as blockchain and peer-to-peer systems, have become the foundation for new technologies that ensure the security and transparency of operations without the need for centralized control authorities. These networks enable interaction between nodes without prior trust. However, ensuring reliable and efficient authorization in such networks presents a challenge due to the absence of a single authorization center. This creates the need to develop new models that allow secure access management based on the interaction between nodes. One of the main issues is that each node can potentially be malicious, and traditional authorization models used in centralized systems cannot provide the necessary level of security. The purpose of this study is to explore new approaches to authorizati on in public decentralized networks that do not require trust between participants. M e t h o d s . The research investigates reputation-based authorization models and Proof of Useful Work (PoUW) models, which show promise for decentralized systems. The reputation model grants access rights based on the node's previous activity in the network, where each node accumulates reputation points for completing specific tasks. The second model, PoUW, allows nodes to gain authorization based on the number of useful computations performed. This approach not only enhances network security but also incentivizes nodes to carry out computational tasks that have practical value for the community. R e s u l t s . Modeling has shown that both models effectively ensure the security and reliability of interaction between nodes. Nodes with a high reputation level or those that have completed a significant volume of useful computations gain access to critical network resources. The implementation of such approaches reduces the risk of malicious activity, as nodes that do not perform useful actions are restricted in their access rights. C o n c l u s i o n s . The proposed authorization models based on reputation and Proof of Useful Work have demonstrated high efficiency in public decentralized networks. They enable secure interaction between nodes without the need for trust, making these approaches promising for future implementation in various fields. The use of these models provides dynamic access management to resources, minimizing the risks of malicious activity.
USAGE OF OPEN-SOURCE INTELLIGENCE FOR SECURITY OF CRITICAL INFRASTRUCTURE
B a c k g r o u n d . In the metter of critical infrastructure, it refers to the systems and assets that are essential for the functioning of modern society and the economy. These sectors include energy, transportation, elecommunications, healthcare, and water supply, all of which are crucial for national security and public well-being. Disruptions in these infrastructures can lead to decent amount of social and economic vital consequences. With the technologies happening to become more advanced, critical infrastructure security systems have become more complex and affiliated. Alterations in example being smart grids, automated transportation systems, and sophisticated communication networks have enhanced efficiency but also increased vulnerabilities. The convergence of digital and physical systems makes these sectors more exposed to risks like cyberattacks, natural disasters, terrorism, and other threats. This growing complexity emphasizes the need for governments and organizations to prioritize the protection of these vital infrastructures. M e t h o d s . In this research, we developed a mathematically rigorous approach to OSINT in the protection of critical infrastructure, improving on existing methods by providing a structured model for threat detection, vulnerability assessment, and risk calculation. The proposed method employs mathematical representations and probability functions, ensuring a more accurate analysis of threat information and vulnerability scoring. This advancement enables more precise mitigation strategies and better response coordination. While existing OSINT methods rely heavily on unstructured data collection and analysis, our approach introduces a mathematical foundation for data gathering and threat evaluation, providing several key improvements, such as Mathematical Representation of Data; Probabilistic Threat Detection and Vulnerability and Risk Assessment with Weighted Metrics. R e s u l t s . The study's findings underscore the value of a quantitative OSINT model in critical infrastructure security, demonstrating improvements in accuracy, speed, and decision-making. By reducing ambiguity through probabilistic risk assessments, the model minimizes unnecessary alerts and focuses on actionable threats. Scalability testing showed the model could handle large datasets effectively without overwhelming analysts. Finally, objective risk assessments were validated as enhancing decision-making processes, thus proving beneficial in real-time threat detection and mitigation. The model provides a solid foundation for continuously evolving OSINT practices and suggests potential for further optimization by minimizing risk and balancing mitigation efforts through a defined objective function. C o n c l u s i o n s . After all conducted analytical works, we could definitely say that this mathematical model demonstrates how OSINT can be systematically used to enhance the security of critical infrastructure by assessing vulnerabilities, detecting threats, calculating risk, and applying targeted mitigation strategies. It leverages data collection from open sources, threat analysis, and continuous feedback to ensure that infrastructure systems are resilient to evolving risks.
ARTIFICIAL INTELLIGENCE SYSTEMS IN CYBER SECURITY AND THEIR CAPABILITIESFRONT MODERN CYBER THREATS
B a c k g r o u n d . In recent years, the level of cybercrime has grown rapidly. The complexity and diversity of these threats has forced organizations to prioritize advanced cybersecurity solutions, including the use of artificial intelligence technologies that can quickly analyze data to identify potential threats and anomalies. By 2027, the AI-based cybersecurity market is expected to exceed $46 billion. However, as AI strengthens and refines defenses, cybercriminals are adapting by exploiting vulnerabilities and even using AI to enhance attacks. This dual use of AI underscores the need for balanced and intelligent strategies that combine the predictable capabilities of AI with human knowledge and talent. M e t h o d s . My Research highlights effective risk prevention strategies, including promoting a security-aware culture, implementing strong passwords and two-factor authentication, regularly assessing and updating systems, enhancing firewalls, and adhering to cybersecurity regulations. AI proves valuable in threat detection and response, giving companies a competitive edge, though it raises concerns about reducing human roles in security tasks. R e s u l t s . The research indicates that AI positively impacts cybersecurity by enabling faster detection and response to threats, allowing organizations to proactively identify and address vulnerabilities. Companies that integrate AI into their cybersecurity strategies gain an advantage in managing complex cyber threats. However, concerns persist about AI's dual-use nature, as it could also be leveraged by cybercriminals for advanced attacks. This potential for AI to operate independently raises questions about the diminishing role of human oversight. Ultimately, the findings stress the need for a balanced approach: while AI is essential for modern cybersecurity, human involvement remains crucial. Continuous adaptation and a blend of technological and human expertise are necessary to protect critical infrastructure and data. C o n c l u s i o n s . To summarise, the rapid growth of cybercrime underscores the necessity for robust cybersecurity measures to protect sensitive information and ensure operational integrity. Artificial Intelligence is becoming crucial in enhancing cybersecurity through advanced threat detection, pattern recognition, and predictive analysis. While AI offers significant benefits, it can also be exploited by cybercriminals, highlighting the importance of vigilance and innovation in security strategies. Despite advancements in AI, human expertise remains vital for interpreting insights, making informed decisions, and adapting to new threats. A multi-faceted approach, including employee training, regular audits, and strong data protection, is essential for effective cybersecurity. Enhanced cooperation among organizations, governments, and international partners is crucial for developing effective strategies to combat cybercrime. Continued research into AI capabilities and ethical considerations is necessary to address the evolving landscape of cybersecurity threats.
METHODS OF EXTRACTING CYBERSECURITY OBJECTS FROM ELECTRONIC SOURCES USING ARTIFICIAL INTELLIGENCE
B a c k g r o u n d . The rapid development of information technology (IT) has led to new threats and challenges in the field of cybersecurity. Cyber warfare has become a reality and a real problem for states, organizations and individual users of cyberspace. Ukraine is taking a number of measures to develop a system of cyber actions in cyberspace, which include a set of interconnected subsystems of cyber intelligence, cyber defense, cyber influence and cyber counterintelligence. One of the forms of cyber intelligence is open-source computer intelligence (OSINT), which is used to search for and obtain intelligence information, including the identification and analysis of cybersecurity objects to predict possible manifestations of cyber threats and their consequences. This requires the development of effective methods for detecting and analyzing cybersecurity objects by extracting factual data on cybersecurity objects from large amounts of unstructured textual information. M e t h o d s . The paper investigates artificial intelligence technologies, in particular, large language models (LLM) and generative artificial intelligence (GenAI) in the context of their application to solve the problems of computer intelligence of cybersecurity objects from open electronic sources and social networks. R e s u l t s . As a result of the study, in order to carry out an effective analysis of the results of information extraction, a methodology for extracting named entities - the names of hacker groups and their contextual connections from the texts of messages of electronic network sources related to the subject area of cybersecurity, as well as the formation of networks of their interconnections and a substantive analysis of these networks is proposed. To identify the actors involved in cyber warfare, the author proposes a methodology for analyzing selected documents available in electronic sources on the Internet and social networks. Both methods are based on the use of artificial intelligence. C o n c l u s i o n s . The results of the study demonstrate the effectiveness of the proposed approaches and the possibility of their practical application in solving cybersecurity problems. The proposed methods can be an important tool for cybersecurity professionals to develop effective strategies to protect against cyber threats.
PROTECTION MODEL AGAINST DISTRIBUTED GRADUAL DEGRADATION ATTACKS BASED ON STATISTICAL AND SEMANTIC APPROACHES
B a c k g r o u n d . Nowadays, every critical sector of social institutions conducts its operations on top of distributed processing systems. Contemporary digital infrastructure heavily relies on user-provided data in its operation. As a result, distributed attacks based on botnets are in a continuous state of arms race with the protection methods that filtrate malicious data influx. A common method to do so often relies on heuristics and human-oriented verifications. As the new advancements in the field of artificial intelligence emerge, such attacks adopt new oblique paths towards achieving their goals. The successful execution of the said plan could lead to a gradual resource depletion on the target system. The purpose of this research is to address such threats with a combination of statistical and semantic approaches. M e t h o d s . The following research conducts a theoretical analysis and systematization of the distributed gradual degradation attack in distributed systems and its implication in the context of the evolving technologies of artificial intelligence. Mathematical modeling is leveraged to define the proposed model's properties and execution process. The proposed model heavily relies on statistical methods for analyzing time series data and its deviations, as well as classification neural networks for semantic detection of suspicious behavior. R e s u l t s . As a result of the following research, a new model is developed that leverages statistical and semantical verification for anomaly detection. The continuous monitoring and detection process is optimized towards highly loaded systems with a constant flurry of data streams. C o n c l u s i o n s . Since the distributed attacks could be potentially equipped with intelligent means to bypass existing security measures, the development of a protection model against potential resource leaks is gaining relevance. The recent success in the development of artificial generative intelligence leads to raising concerns about the safety and adequacy of the current security measures against automation-based distributed attack vectors. It is often a case that the protection models are inclined towards prevention of the attack rather than recovery. This approach, while targeting the source of risks, often leads to complacent design decisions without considering the potential outcomes of a successful breach. The proposed model provides a theoretical foundation for building systems that both react to the active execution of threats and perform recovery mechanisms, assuming that the attack may potentially bypass initial security measures.
JAVASCRIPT-BASED WEB EXPLOIT ANALYSIS MODEL
B a c k g r o u n d . The task of ensuring the security of web applications and servers remains important and relevant in the face of the ever-increasing number of attacks in cyberspace. The use of various open-source content management systems (e.g. WordPress, Joomla, Open Journal Systems, Drupal), which are quite popular for creating websites due to their ease of installation and use, unfortunately, require constant updating not only to improve the content but also to ensure the security of the system. In this article, the authors focus on the WordPress system, although this approach can be used for other systems as well. The article emphasises the importance of early detection of vulnerabilities to prevent potential cyber threats and their negative consequences. The article proposes a model and a script designed to speed up the detection of vulnerabilities in WordPress applications. Automation of the scanning process with a custom script allows you to quickly detect vulnerabilities, ensuring prompt fixes and updates. This approach not only strengthens security, but also helps preserve the reputation of websites and brands, which is critical in today's digital environment. M e t h o d s . The methods of analysing JavaScript-based web exploits were used, taking into account the general principles of their analysis and taking into account the methodologies for analysing web applications for vulnerabilities. R e s u l t s . An improved model of analysing a web application on CMS Wordpress based on a script that provides automated scanning of a web application by running the following utilities is presented: NMAP, Dirb, Nikto, SQLMap, WPScan and PwnXSS. All the results are recorded in a separate file for further study of all the found security issues of the web application. C o n c l u s i o n s . The developed model and script should help developers and testers speed up the process of identifying vulnerabilities in Wordpress, as they can run one script and get a voluminous and meaningful report with the identified vulnerabilities in a short time. This optimises vulnerability detection by automating the launch of scanners.
Copyright (c) 2025 Information systems and technologies security
OPTIMIZATION OF BUFFER AND PRIORITIES FOR ENSURING SECURITY IN BLUETOOTH NETWORKS
B a c k g r o u n d . The optimization of buffer zone size for information protection plays a crucial role in ensuring the security of video streaming over Bluetooth wireless networks, particularly given the increased data transmission speeds and the use of adaptive modulation with a three-tier buffer. Recent studies show that proper management of buffer size can significantly enhance the quality of video data transmission and reduce security threats. An important aspect of ensuring security in video streaming systems over wireless networks like Bluetooth is the integration of cutting-edge information protection technologies. Modern trends in cybersecurity encompass key elements such as data encryption, access control, and multi-factor user authentication. These mechanisms not only protect data from unauthorized access but also ensure its integrity and confidentiality at every stage of processing and transmission. M e t h o d s . The study employed analytical methods including modeling and simulation, statistical and comparative analysis, experimental research, and risk assessment, enabling a comprehensive understanding of data transmission quality management in Bluetooth networks under cross traffic conditions. R e s u l t s . Properly configuring the buffer zone size can significantly enhance the efficiency and reliability of protecting critical data from unauthorized access and cyberattacks. Modern approaches to buffer size optimization utilize traffic analysis and modeling methods, as well as machine learning algorithms to predict traffic volumes and characteristics. For instance, clustering algorithms can be employed to identify traffic types and characteristics, allowing for more efficient resource allocation and buffer space management. To effectively optimize the buffer zone size, it is essential to consider system performance and information security standards, including ISO/IEC 27001 and ISO/IEC 27002. ISO/IEC 27001 outlines requirements for information security management systems, emphasizing risk assessment and the implementation of security measures. ISO/IEC 27002 provides recommendations for data protection, such as the use of cryptographic methods. The buffer zone size must meet the requirements of cryptographic algorithms and ensure resilience against attacks such as DoS and buffer overflow, while also considering scalability and compliance with contemporary regulations. C o n c l u s i o n s . Optimizing the buffer zone size in the context of video data transmission over Bluetooth networks is a critical aspect that affects not only the stable operation of the system as a whole but also the effective management of traffic flows, allowing for improvements in information transmission quality and significantly reducing potential risks from external cyberattacks and internal failures that may arise due to cross traffic or other network anomalies. The application of adaptive signal modulation in close interaction with three-tier data buffering enables the system to dynamically adjust to variable communication channel parameters, such as transmission speed, noise levels, and interference. This, in turn, helps maintain a high level of video stream quality even under adverse environmental conditions and increased signal variability. The integration of three buffer levels, each performing distinct storage and preprocessing functions for incoming data, creates an additional protective barrier that significantly minimizes the negative impact of external factors on system stability, particularly by preventing possible delays, interruptions, or data loss that may arise due to changing environmental conditions or network impediments during information transmission.
IMPROVING THE METHOD OF DETECTING RADIO SIGNALS USING TOPOLOGICAL THREAT IDENTIFICATION
Background. Humanity has entered the era of information value. An era in which information becomes a more important resource than other resources. Therefore, access to information, especially to conference information, especially to information that contains the main competitive advantages, is the primary task of competitive intelligence. Obtaining such information is most often associated with breaking the law and using special technical means. Complex data breaches can now be resolved at a faster pace, but tech intelligence professionals can use new ways to penetrate your system to steal valuable information and cause irreparable damage. Methods. The work examines the methods of detecting dangerous radio signals, which can be signals from radio jamming devices. An improved method of detecting radio signals is proposed, the improvement is based on the use of topological identification of threats. The method is based on the fact that the object of information activity must be divided into fractals, that is, areas of self similarity. Areas of self-similarity are determined by the physical properties of radio signals. In addition to the fractal dimension, in order to significantly increase the probability of detecting dangerous radio signals, introduce the appropriate fractal measures as the identification of radio signals. Fractal measures additionally allow you to determine the zones in which dangerous radio signals are detected. By setting the appropriate reference values of the relevant parameters of radio signals, it is possible to determine the fractal dimensions through the Hurst index and, depending on the obtained dimension value, it is possible to identify dangerous radio signals, signals of radio interceptor devices or other information capture devices that are installed at the facility with conference information. The use of the proposed method allows to increase the efficiency of detection of signals of radio interceptor devices and, in case of detection of such signals, to block the channel of information leakage. Results. According to research by analysts, 76% of international companies and government institutions have encountered industrial intelligence. With the help of technical means, 80-90% of the necessary information is extracted. In this regard, keeping commercially important information secret allows us to successfully compete in the market for production and sales of goods and services. The attacker uses technical means to gain access to commercial information. One of the types of technical means is a radio device. For the transmission of information, a transmission channel of the received information is created. Therefore, the issue of identifying and blocking information leakage channels is very important. Conclusions. It is proved that using the methods of fractal geometry, it is possible to divide the object of information activity into fractals, into areas of self-similarity. The criteria by which these areas are determined are determined by the physical principles of embedded devices. By setting the corresponding reference values of the corresponding parameters, it is possible to determine the fractal dimensions through the Hurst index.
Background. This article presents ChatGPT - a new chatbot, one of the latest products in the field of artificial intelligence, created by OpenAI, which developed this technology together with Elon Musk. The article provides recommendations for connecting to a chatbot. The main advantages of artificial intelligence are defined, and examples of its application are given. Current educational processes should develop a cross-disciplinary and practice-oriented approach in the student. Results. It is shown that among the main advantages of ChatGPT is the ability to generate texts on a given topic, to answer almost all user questions, and to express oneself even in Ukrainian. Specific examples of chatbot questions related, in particular, to information protection, risk management, etc., are given. Demonstrated responses from his side. Focused on the dangers of using a new chatbot. It is shown that possible plagiarism, compatibility issues, malicious use, privacy issues, copyright infringement issues, and problems of using ChatGPT in the educational system occupy a special place among the identified dangers. It is emphasized that the education system is currently experiencing a significant crisis and that the process of obtaining knowledge is adequate to the challenges of today, it is necessary to radically revise the approach to what the current teacher and the educational process itself should be. It is noted that Ukraine needs a fundamental transformation of the very essence of the education system. Now the main task of the teacher is to give the student himself the opportunity to take the initiative in learning, to effectively use the information received, to combine it and to apply the received result in solving his task. A successful student must learn to solve complex tasks that are at the junction of various subjects and disciplines. Conclusions. So, ChatGPT is a powerful tool, but today it has some drawbacks that should be considered if you plan to use it.
STUDY OF THE THEORETICAL CORRESPONDENCE INDICES FOR THE UKRAINIAN ALPHABET WITH SPACES
Background. Theoretical compatibility indices play an important role in identifying the weaknesses of cryptographic systems and ensuring their stability. After analyzing the available sources of information, this indicator was not found for the Ukrainian alphabet with a space, which makes it impossible to find accurate results in calculations where this indicator is used. Methods. Theoretical correspondence indices have a wide range of applications, but they are most often used in Friedman's First Method when calculating the key size for the Vigener cipher, which is used in the study of the basic concepts of cryptographic systems. The general algorithm for finding indices of theoretical correspondence for the Ukrainian alphabet with a space based on the analysis of a large sample of texts is considered. Results. For calculations, 700 texts were analyzed, the size of which is 1500 elements. The texts were selected using an API from Wikipedia, a free and open multilingual online encyclopedia. The calculation took place for keys of size from 2 to 7. The index of theoretical correspondence was calculated in two stages. At the first stage, practical indices of correspondence were calculated for the whole range of texts, and then, using the standard deviation of the sample, the interval of the most repeated indicators was calculated. The program code for implementing the index calculation algorithm was presented in the form of project components responsible for various aspects of the process. As a result of the study, a variation of the values of the correspondence index was found depending on the size of the text, which emphasizes the need to consider the length of the text in the analysis and development of cryptographic systems, in particular, the selection of encryption keys. It was concluded that the size of the text can affect the results of the calculation of the compatibility indices, but it does not significantly affect the overall security and effectiveness of encryption. Conclusions. In the course of the work, an analysis of the Ukrainian alphabet with a space and its properties was carried out. An algorithm for calculating the index of theoretical correspondence for this alphabet was also developed and implemented. The index of theoretical correspondence was experimentally determined for various texts in the Ukrainian language using the developed algorithm.
MODEL OF IMPLEMENTATION OF MANAGEMENT OF ACCESS TO INFORMATION ASSETS IN THE CONCEPT OF ZERO TRUST
Background. Controlling access to information assets is one of the key functions of information security. This task in one form or another must be solved both as a whole at the level of the entire information technology (IT) infrastructure of a company or organization, and in each local information system. Methods. Methods on existing approaches, the article develops a model for providing access to information assets, which allows implementing access control processes in a distributed IT infrastructure. A special feature of the model is an algorithm for dynamically determining the necessary security policies, taking into account the access of users with different privileges. Results. The model takes into account remote access at several conventional "levels" – access of the organization's clients, organization employees, as well as partners and contractors. Since modern information infrastructures of organizations have become complex and distributed, the model assumes the presence of a significant number of access points, including automated workstations in the infrastructure, remote automated workstations, various user and mobile access devices, as well as specific devices, such as effective access control should ensure centralized access of all users to information assets. Conclusions. The model provides for the implementation of a single access point, built on the basis of access models from the zero trust concept, for users and for "robots" – technical accounts used for inter-system interaction. The results of the study will make it possible to develop an architecture for remote user access to distributed information assets and organize access control and management processes based on dynamic determination of the level of trust in access subjects, which generally increases the security of organizations.
COMPARISON OF POST-QUANTUM STANDARDS IN TERMS OF IMPLEMENTATION IN CLASSICAL ELECTRONIC SIGNATURE ALGORITHMS
Background. The work examines the development and promotion of post-quantum standards, as well as the analysis and improvement of existing algorithms, on the basis of which the functioning of standards in the field of electronic digital signature can be based. One of the main reasons was also the migration of classical cryptography to post-quantum cryptography. The robot is aligning three popular post-quantum standards: CRYSTALS-Dilithium, Falcon and SPHINCS+. As a result of the investigation, the most optimal standards were selected before implementation of classical electronic signature schemes. The article is dedicated to the development and promotion of post-quantum standards in the field of electronic digital signature. It is also necessary to analyze and level up existing algorithms, on the basis of which the functioning of such standards can be based. The research is considered relevant due to the growing interest in quantum technologies and the need for secure electronic communications in the upcoming quantum world. Мethods. Мigrating classical cryptography to post-quantum cryptography. However, power is important, because the power of quantum computers can be affected by certain cryptographic algorithms. An analysis of the feasibility of transitioning to new standards and their existing security capabilities is also carried out. In addition, three popular post-quantum standards are being updated: CRYSTALS-Dilithium, Falcon and SPHINCS+. This allows us to determine the most optimal and reliable standard for implementation of classical electronic signature schemes. The authors of the work carry out the selection of the optimal standard, ensuring the safety and security of its authorities. Results. Сontains important results from the study of post-quantum standards for electronic digital signatures, which may be useful for developers of cryptographic software and information security engineers. The power supply to the influences and changes in the advanced post-quantum standards, such as the complexity of implementation, the flexibility of infrastructure and power standardization, are thoroughly examined. The prospects for the future development of post quantum cryptography and its influx into modern electronic signature systems have also been highlighted. This will help readers to take away the more common sense and context of the importance and potential contributions in this area. Conclusions. Falcon and CRYSTALS-Dilithium have a high signing fluidity and a larger key size, making them practical for rich stagnation. SPHINCS+, regardless of its viscosity, has less fluidity and requires a larger key size. The choice between CRYSTALS-Dilithium, Falcon and SPHINCS+ will depend on the specific drying needs, as well as compromises between fluidity, key size and viscosity. This demonstrates the high speed of subscription, and this is one of its key advantages. It is intended for use in quick operations, for example, on servers and industrial systems.
COMPARISON OF MATURITY MODELS OF INFORMATION SECURITY PROCESSES OF AN ORGANISATION (COMPANY)
Background. The increase in malicious activity in the information and cyberspace poses a challenge to the leaders of enterprises (organizations) and the leaders of companies with additional tasks and benefits to protect their assets. The loss of assets, for example, financial or technological, can make it impossible for the company to achieve its basic function - to generate profits. Methods. The work used the information security risk analysis method. Results. Сreation and promotion of current information security systems. Organizations spend significant financial resources on the development and operation of technology protection, create various structural subdivisions, such as the assessment and provision of a similar level and information security of the enterprise (company). At the same time, there is a real risk of the current situation if malicious and more current technologies are able to rig the system to protect the company and cause irrevocable costs, both financial and reputational. Сonclusions. One of the main directions of this problem is the creation of an information security management system (ISMS), which is a warehouse management system for an organization (company) and is assessed without bears the risks of creating, implementing, operating, operational monitoring, review, support and thorough information security organizations (enterprises). The ISMS includes the organizational structure of the organization (company), its policies, nutritional planning, monitoring of labor costs, promotion of daily practices, control and support of resource processes. As a best practice, to assess the level of information security of an organization, it is recommended to use a different approach that is based on the capabilities of process maturity models. The extracted results can be used to thoroughly and optimize the created information security system of the organization (company). There are currently a wide range of information security maturity assessment models available to organizations based on similar principles. In this case, it is realistic to select such models to be limited, first and foremost through a weak connection to the characteristics of specific organizations. The work examines models of the maturity of processes, their structure and the ability to evolve in the course of assessing the level of information security.
PECULIARITIES OF ENSURING THE SECURITY OF CRITICAL INFRASTRUCTURES
Background. The rapid development of information technologies over the past two decades has impacted the functioning of critical infrastructure facilities. These technologies have begun to be used not only for the exchange and processing of information, but also as a tool for reducing harm. The protection of sovereign interests in the political context is the primary basis for ensuring the national security of the country, which explains the need for the creation and constant development of strong cyber security. Critical infrastructure facilities are foldable, spaciously distributed, rich in component systems, the stability of the robot is critical for the functioning of the economy and the livelihood of the household. They have a rich structure, which includes: a range of technical components; social rheum; organizational level and level of state governance. Мethods. For monitoring information systems and methods for assessing the security of systems. Results. The investigation of critical infrastructures as socio-technical systems will require an assessment of the complex interactions between the technical, social and organizational levels of the system. Therefore, it is important to look at critical infrastructure as a whole. In this case, it is necessary to speak at a one-hour close examination of the technical, organizational and social factors that indicate the structure of the system and the dynamics of its development. Schobstecchita to the nonsense of such systems, it is not possible to pray beyond the traditions of the tradition to the zziki projected Riziki, to go to the new paradigmes, and the blessing of the nonsense of the critical sinfrastructure for the criterly wrecks to the designed areas. Due to the need to include the consideration of design basis accidents on critical infrastructure, the scope of surveillance may be expanded accordingly. Come to the point of ensuring the safety of those responsible not only for the creation of dry-barriers that occur ahead of the implementation of project-based accidents that are postulated, but also for the improvement of the resistance and survivability of critical infrastructure times beyond the project inflows, in order to focus on avoided large-scale disasters and troubling interruptions in the functioning of , and the creation of a rich criteria model for assessing the level of security of critical infrastructure objects will give a more comprehensive picture of the status of the critical infrastructure object. Conclusions. The current safety methods for technical systems are divided into systems that have clear boundaries and well defined danger flows. For these systems, a database of accident statistics can be created, which allows for precise evaluation and verification of models. These methods, which are based on case-by-case scenario "trees" (models of the type "tree" of ideas, "tree" of views), were fragmented without the coordination of design inputs and do not allow for proper management of the complexity of critical infrastructures functioning in is determined by the interaction of technical, organizational and social factors.
IMPROVEMENT OF COMPUTER SYSTEM PROTECTION ASSESSMENT METHODS AGAINST HARMFUL SOFTWARE CODE
Background. The issue of ensuring information security (IS) of state information systems today is not only not losing relevance, but with the development of the concept of eGovernment in countries and an increase in the number of e-services, it is becoming increasingly important. Methods. The work used the method of analyzing the evaluation of the protection of the computer system against malicious software code, with the help of the method of optimization and evaluation of the protection of the computer system, the method of malicious software code was improved. Results. The work improving the method of assessing the information security of computer systems from malicious software includes a recommendatory aspect of building e-government. Conclusions. Cybersecurity threats, such as spam, phishing, spyware, and botnets, pose challenges for governments, especially for such young governments in any developing country. Malicious authors (hackers) create new combined threats to counter the security of the information system. New threats make it possible to bypass system firewalls, workstation configurations and various other intrusion detection systems. Many governments are working on cybersecurity legislation to help protect consumers and themselves. Some legislative efforts are focused on establishing government structures to provide support against systemic attacks. Some government legislation has been designed to prosecute criminals in order to deter criminal activity. The legislation has well developed a basis for the detection, analysis and internal prevention of malicious software. To effectively manage cybersecurity threats, governments must be involved from the beginning of the process to the end of the process. Businesses need to know where and to whom to report security risk information, and the government needs to support it. Improving the method of assessing the information security of computer systems from malicious software contains a recommendatory aspect of building an electronic government. The steps of building e-government, in contrast to the existing ones, differ in the completeness of the content of each stage of building e-government.