The etalons models of linguistic variables for sniffing attacks detection - Терейковский, Игорь Анатольевич; Корченко, Анна Александровна; Викулов, Павел Александрович; Шаховал, Александра Анатольевна (Ukrainian Information Security Research Journal, 2017)
The intensive development of information systems has led to an increase in destructive software, many of which are aimed at obtaining confidential information, which is directly related to the emergence of attacks like 0-day and non-signature types of cyber attacks. Expanding the impact of cyber attacks directed at various resources of information systems initiates the creation of special counter-measures that can remain effective when new types of threats emerge with undefined or indistinctly defined properties. There are known, quite effective developments used to solve problems of detecting cyber attacks, for example, the method of forming linguistic etalons for intrusion detection systems, in which the mechanism of the process of forming parameter etalons for attack sniffing is not disclosed. For this purpose, a model of linguistic variables has been developed to detect sniffing attacks, which is due to the evaluation of the state of the information system and the process of forming parameter standards: the number of incoming packets in the network, the speed of processing packets on the receiver side, the timing of packets in the channel, will allow to formalize the process of obtaining parameter etalons for given linguistic variables of a particular environment in solving problems of detecting attacks in computer systems. Such models can be used to improve the effectiveness of information security tools aimed at countering sniffing attacks in computer networks.