The model of heuristic rules on the set of logical-linguistic tangles for abnormality detection in computer systems

Abstract

The drawback of advanced intrusion detection systemsbased on the principle of abnormal condition detection is that they basically are focused on the use of mathematical models, which require a lot of time to produce statistics. The mathematical models based on expert approaches are more effective, but to perform its functions the use of correspondingdecisive rules is necessary. To solve this problem it wasproposed the model of heuristic rules in fuzzy logic, which through the use of multiple pairs “attack parameters” and “attack a set of logical-linguistic tangles”, as well as a universal model of standard parameters allows to display the abnormal condition caused by a specific type of cyber attacks on computer network. Based on this model there were developedsome rules for scan detection, spoofing and Dos attacks which can be practically used to improve abnormality detectioncaused by attackers’ actions in computer systems.