THREAT EMULATOR FOR VERIFICATION OF CYBERATIC DETECTION SYSTEMS - Korchenko, Anna; Dreis, Yurii; Nahornyi, Yurii; Bychkov, Volodymyr (Ukrainian Information Security Research Journal, 2021)
Today, one of the most common information security systems is cyberattack detection and intrusion detection systems, the second have a particular practical and scientific interest. Also, the functionality of modern intrusion detection and blocking systems largely depends on their ability to detect new cyberattacks in real time. Special methods, models, tools, software and comprehensive technical solutions for intrusion detection systems are used to detect appropriate attacks, which are effective with new or modified cyber threats. However, in practice when new threats and anomalies generated by attacking the actions of unidentified or poorly properties, appropriate means are not always effective. Therefore, the development of verification tools and experimental research of relevant technical solutions, tools and software to detect cyberattacks, abuses and anomalies in information systems to confirm the adequacy of their work is an urgent scientific task. There are a number of works, such as a tuple model of attack environments, a number of methods for detecting anomalous states, a methodology for building an intrusion detection system, and a structural model of a computer system to create cyberattacks and its algorithmic and software. To verify it, a specialized cyber threat emulator is needed, as the known ones do not support the necessary data formats used in the author's development. Based on this, the aim is to develop an emulator for experimental research to confirm the reliability of the obtained theoretical provisions, practical results and adequacy of the software module of the developed cyberattack detection system, which will improve the functional properties of modern intrusion detection systems for real time.