Research of the method for selecting security tools in distributed information systems

Abstract

The article is dedicated to solving a relevant scientific and practical task of justifying the selection of information security tools (IST) for distributed information systems (DIS) operating under tight resource constraints and active cyber confrontation. The study's aim is the experimental verification of the effectiveness, adequacy, and viability of the developed game-optimization method, which combines the game-theoretic apparatus for modeling party actions with multi-criteria optimization methods. The methodological basis of the research consisted of a series of computational experiments implemented using proprietary software. These experiments included generating synthetic DIS topologies that account for node heterogeneity, modeling scenarios of a rational attacker's actions, and searching for optimal protective configurations using the NSGA-II evolutionary algorithm. A comparative analysis of the proposed method was conducted against common heuristic resource allocation strategies, such as criticality priority, vulnerability protection, and random choice. The simulation results experimentally confirmed the stated hypotheses, proving that accounting for network topology and cascading damage propagation effects is essential for synthesizing a resilient defense system. The effectiveness of multi-criteria optimization was further confirmed through the construction of a Pareto front in the "risk – cost – coverage level" space. This allowed for the identification of a set of non-dominated solutions that, in aggregate, outperform single-criterion models. Quantitative analysis of the results demonstrated a statistically significant advantage of the developed method. Specifically, it was established that game-optimization strategies provided a reduction in DIS integral risk by 56–58% relative to the initial level, while basic and simplified models demonstrated results only within the 48–55% range. The average residual integral risk for the proposed method was 0.42, which is significantly better than the performance of basic strategies, which varied from 0.44 (for flexible heuristics) to 0.52 (for criticality priority strategies). The absolute reduction in risk relative to the worst-case scenario amounted to 0.10.