Method of intruder detection and identification in information & communication systems

Abstract

The providing of state information resources security is inextricably connected with information security intruder's activity in information & communication systems where restricted data is circulating. The modern intruder detection systems, based on heuristic principle of information security violation detection, have a disadvantage because these are basically oriented on mathematical models which require much time to prepare statistic data. Mathematical models based on expert approach are more effective in this way. The method proposed in paper allows to solve the problem of intruder detection and identifying in information & communication systems and networks, which are weakly-formalized fuzzy environment. In the method elements of fuzzy logic are used to the previous decision of the violation & the intruder identification and precise basis of conventional logic that provides clarifying identification. The method consists of such stages: selection of the method for determining the importance of factors, the formation of categories sets of intruder and parameters, forming standards of fuzzy parameters, forming the set of heuristic rules, forming connections of intruder category with parameters, phasing of fuzzy parameters and definition clear parameters, processing and forming of parameters corteges, results formation. The method's work is organized in three phases: preparation, work with fuzzy parameters and work with clear parameters. On the basis of this method can be synthesized heuristic type intruder detection & identification system with high performance in fuzzy terms by the use of expert methods.