IMPROVED METHOD OF AUTOMATIC ACTIVE ANALYSIS OF CORPORATE NETWORK SECURITY - Kyrychok , Roman; Zinchenko, Olha; Sribna, Iryna; Marchenko, Vitalii; Kitura, Oleh (Ukrainian Information Security Research Journal, 2021)
The article proposes an improved method for automatic active analysis of corporate network security. This method is based on the synthesis of a mathematical model for analyzing the quantitative characteristics of the vulnerability validation process, a methodology for analyzing the quality of the validation mechanism for identified vulnerabilities in a corporate network, and a method for constructing a fuzzy knowledge base for making decisions when validating vulnerabilities of software and hardware platforms. In particular, the mathematical analysis model, which is based on Bernstein polynomials, allows describing the dynamics of the vulnerability validation process. A methodology for analyzing the quality of work is based on integral equations that take into account the quantitative characteristics of the investigated vulnerability validation mechanism at a certain point in time, which makes it possible to build laws for the distribution of quality indicators of the vulnerability validation process and quantitatively assess the quality of the validation mechanism for the identified vulnerabilities. The method of building a fuzzy knowledge base is based on the use of fuzzy logic which makes it possible to obtain reliable information about the quality of the vulnerability validation mechanism in an indirect way and allows the formation of final decision-making rules for the implementation of one or another attacking action during the active security analysis of corporate network. This allows, in contrast to existing approaches to automating active security analysis, to abstract from the conditions of dynamic changes in the environment, that is, the constant development of information technologies. This leads to an increase in the number of vulnerabilities and corresponding attack vectors, as well as to an increase in ready-to-use exploit vulnerabilities and their availability, taking into account only the quality parameters of the vulnerability validation process itself.