-The article considers possible solutions of to the relatively new scientific-technical problem of developing an earlywarning cybersecurity system for critically important governmental information assets. The solutions proposed are based on the results of exploratory studies conducted by the authors in the areas of Big data acquisition, cognitive information technologies (cogno-technologies), and “computational cognitivism,” involving a number of existing models and methods. The results obtained permitted the design of an early-warning cybersecurity system.
INTRODUCTION
Nowadays, the information confrontation plays an increasingly important role in modern, “hybrid” wars. Furthermore, victory is often attained not only via military or numerical superiority, but rather by information influence on various social groups or by cyberattacks on critically important governmental infrastructure.
In this regard, means for detecting and preventing information and technical impacts should play a crucial role. Currently, systematic work is being done in Russia to create a National Cyberattack Early-Warning System. A number of state and corporate cybersecurity response system centers have already been organized.
However, the technologies applied in these centers allow only the detection and partial reflection of ongoing IT-attacks, but they do not have the capacity to predict and prevent attacks that are still in the preparation stage [1].
Such a situation requires the creation of fundamentally new information security systems which are capable of controlling the information space, generating and simulating scenarios for the development, prevention and deterrence of destructive information and technical impacts, and to initiate proactive responses to minimize their negative impact. New technologies in big data and deep learning as well as in semantic and cognitive analysis are now capable of proactively identifying the invader’s hidden meanings and goals, which the other types of analysis could not discover, will likely play an instrumental role here. This article aims to develop these methods and technologies.
II.
WARNING CYBERSECURITY SYSTEM
At the same time, it is impossible to implement a National Cyberattack Early Warning System without also tackling a series of related issues. Most notably, this will necessarily entail the creation of an effective computing infrastructure that provides the implementation of new methods and technologies for modeling the development, prevention and deterrence of destructive information and technical impacts in real-time, or even preemptively. Clearly, this problem will not be solved without high-performance computing systems or a supercomputer.
We must confess that Russia currently lags far behind leading Western countries in terms of its supercomputer technology. Cluster supercomputers primarily used in our country are usually based on a СKD assembly from commercially available foreign processing nodes and network switches. It is well-known that this class of supercomputers demonstrates its optimal performance when solving loosely bound problems not requiring intensive data exchange between processor nodes.
The actual performance of cluster supercomputers, however, is significantly reduced when solving. While the solution of tightly bound problems, in particular semantic and cognitive analysis of big data. Moreover, the attempts to increase the cluster system performance by increasing the number of processing nodes have often not only failed to yield positive results, but, on the contrary, have had the opposite effect due to a heightened proportion of non-productive “overhead” in the total solution time which arises not from “useful” processing, but from organizing a parallel calculation process.
These fundamental disadvantages of modern cluster supercomputers are a product of their “hard” architecture, which is implemented at the stage of computer construction and cannot be modified while being used [1-4].
Developed by Russian scientists, the concept of creating a reconfigurable supercomputer made it possible to configure the architecture setup (adjustment) depending on the structure of the task’s solution without entailing the aforementioned disadvantages. In this case, a set of field programmable logic devices (FPLG) of a large integration degree comprises the entire computing field and enables the user to create the taskoriented computing structures similar to the graph algorithm of the given task; this is used as a supercomputer computational device, rather than a standard microprocessor. This approach ensures a “granulated” parallel computing process as well as a high degree of time efficiency in organization achieved by adjusting the computing architecture to the applied task.
As a result, near-peak performance of the computing system is achieved and its linear growth is provided, when the hardware resources of the FPLG computational field are increased [5-8].
Today, reconfigurable FPLG-based computing systems are increasingly finding use in solving a number of topical applied tasks, primarily computationally labor-intensive and “tightly coupled” streaming tasks that require mass data processing (streams), as well as tasks that require the processing of nonstandard data formats or variable number of bit (e.g. applied fields of big data semantic and cognitive analysis, cryptography, images processing and recognition, etc.).
This allows us to estimate the prospects of using reconfigurable supercomputers technology when establishing a National Cyberattack Early-Warning System [1].
III.
OF NATIONAL SUPERCOMPUTER GRID
NETWORK
At the same time, one supercomputer, even the most productive one, is not enough to create the computing infrastructure of the National Cyberattack Early-Warning System.
Obviously, such a system should be built based on a network of supercomputer centers, with each unit having its owntask focus, while preserving the possibility to combine all the units into a single computing resource; this would, de facto, provide a solution to computationally labor-intensive tasks of real-time and preemptive modeling development scenarios for prevention and deterrence of the destructive information and technical impacts. In other words, the National Cyberattack Early Warning System should be based on a certain segment (possibly secured from outside users) of the National Supercomputer GRID network.
Furthermore, establishing a National Supercomputer GRID-Network evokes a complex problem of optimal distribution (dispatching) of computational resources while solving a stream of tasks on modeling development scenarios for cyberattack prevention and deterrence [9].
Nowadays, the problem of dispatching distributed computer networks is being solved with uniquely allocated server nodes. However, such centralized dispatching is effective when working with a small computational capacity or nearly homogenous computational resources. However, in cases of numerous, heterogeneous network resources, the operational distribution (also redistribution) of tasks, not to mention of informationally relevant subtasks via a single central dispatcher becomes difficult to implement. Moreover, using a centralized dispatcher significantly reduces the reliability and fault tolerance of the GRID network, since a failure on the part of the service server node that implements the dispatcher functions will lead to disastrous consequences for the entire network.
These disadvantages can be avoided by using the principles of decentralized multi-agent resource management of the GRID network. In this case, software agents which are physically implemented in each computational resource as part of the GRID network play the main role in the dispatching process and represent their interests in the dispatching process. Each agent will know the computing capabilities of “its own” resource, as well as responsively track all changes (e.g. performance degradation owing to the failure of numerous computing nodes).
Given this information, the agent can “allocate” its resource for solving tasks where “its” resource will prove most effective. If the computing resource of one agent is not enough to solve the problem in the given time duration, then a community of agents will be created, with each one providing its resources for solving the various parts of a single task.
The benefits of a decentralized multi-agent dispatching system in a National Supercomputer GRID-network are manifold: • Ensure efficient loading of all computational resources included in the GRID network, by using up-to-date information about their current status and task focus; • Ensure the adaptation of the computational process to all resource changes in the cloud environment; • Reduce the overhead costs for GRID network organization due to the absence of the need to include special service servers as a central dispatcher; • Increase the reliability and fault tolerance of the GRID network and, as a result, dependable computing, since the system will not have any elements whose failure may lead to disastrous consequences for the entire network [4, 7-8].
IV.
SECURITY SYSTEM
As a technological basis for solving this problem, it is
proposed to consider modern software and hardware systems
for analyzing and processing information security events [
The Russian Federation has already established a number of state and corporate centers for detecting, preventing, and recovering from cyber-attacks or centers for responding to cyber security incidents, which are similar to foreign CERT / CSIRT / SOC in their functionality. In domestic practice, they are known as SOPCA. Some examples include, inter alia, GOV-CERT.RU (FSS of Russia), SOPCA of the Ministry of Defense of Russia, FinCERT (Bank of Russia), Rostechnologies CERT, Gazprom SOC, etc.
The Russian Federation Presidential Decree No 31c of January 15, 2013 “On the establishment of a state system for detecting, preventing, and recovering from cyber-attacks on Russian information resources” establishes that the Russian FSS is making methodological recommendations on the organization of protection of the critical information infrastructure of the Russian Federation and organizes work on the creation of a State and corporate segments of Monitoring in the Detection, Prevention and Cyber Security Incident Response (SOPCA).
The concept of a state system for detecting, preventing, and recovering from cyber-attacks on Russian information resources No K 1274, was approved by the President of the Russian Federation on December 12, 2014, defines the state SOPCA system image based on special centers for detecting, preventing, and recovering from cyber-attacks, divided into centers:
Russian FSS (created to protect information resources of the public authorities); State and commercial organizations (created to protect their own information resources).
In addition, these centers are coordinated by the National Coordinating Center for Computer Crimes under the FSS of Russia.
At the same time, in practice, the task to develop a cognitive early warning system for cyber-attacks on the information resources of the Russian Federation was far from being trivial.
It was necessary to conduct appropriate scientific research
and solve a series of complex scientific and technical
problems – e.g. input data classification, identifying primary
and secondary signs of cyber-attack, early cyber-attacks
detection, multifactor prediction of cyber-attacks, modeling of
cyber-attack spread, training, new knowledge generation on
quantitative patterns of information confrontation – many of
which did not have ready standard solutions [
In addition, it was essential to ensure the collection,
processing, storage of big data, as well as carrying out
analytical calculations on extremely large amounts of
structured and unstructured information from a variety of
Internet / Intranet and IoT / IIoT sources (big data and big data
analytics) [
TABLE I. REQUIREMENTS FOR COGNITIVE SYSTEMS detection of incidents and security threats by applying the following models to the incoming data stream: - various parameters excess / decrease detection, setting thresholds for these parameters; - detection of deviation from normal values for various parameters; - detection of statistical deviations from standard behavior for various parameters in the time window; multifactor analysis; - parameters correlation and incidents on selected time interval graphs; - classification models to detect correlation of parameters from various sources with incident occurrence; - clustering models for detecting parameters correlation over a given time interval, etc.
Appropriate technological solutions for creating a cognitive early warning for cyber-attacks on Russia's information resources are represented in [1].
Here, the choice and implementation of the big data processing component represented an important task.
Another important task was the structure of big data storage structure. Many known solutions (e.g. Cassandra or HBase), proved to be of little use due to the following limitations:
Lack of database components to ensure efficient storage and retrieval by time series (most known solutions do not contain integration tools due to their closeness, and those available (e.g. InfluxDB) do not have a high level of work stability);
Absence of the logical connections between the interfaces of business logic and the database;
System functionality duplication due to the database and the processing logic being separated in a heterogeneous solution environment;
Limited performance of the HBase solution, associated with the architectural solution features;
Significant overhead Cassandra, associated with the synchronization of data on various nodes, etc.
Possible system architecture of the cognitive early warning system for cyber-attacks on information resources of the Russian Federation based on NBIC technologies is presented in [1]. The positive experience gained in the creation of a cognitive early warning system for cyber-attacks of SHC “Warning-2018” speaks to the expediency of a methodical approach to solving the task.
Stage 1. Developing the technical component of a traditional SOPCA based on big data technologies is the creation of a high-performance corporate (state) segment of detecting, preventing, and recovering from cyber-attacks.
Stage 2. Creation of the SOPCA analytical component based on “computational cognitivism” is the realization of the cognitive component of the cyber-attack early warning system capable of independently extracting and generating useful knowledge from large volumes of structured and unstructured information for SOPCA operational support.
In this case, the above-mentioned technical component of SOPCA based on big data technologies should be appropriately allocated with the following functions: Big data on the information security state in controlled information resources collection;
Data detection and recovery after cyber-attacks on information resources;
Software and technical tools for IS events monitoring support; Interaction with the state SOPCA centers; Information on the detection, prevention, and recovery from cyber-attacks, etc. (Fig. 1. Technical component of SHC “Warning-2016”
The analytical component based on “computational cognitivism” should be appropriately allocated with the following functions:
An early warning system for cyber-attacks on information resources; Identification and generation of new useful knowledge about qualitative characteristics and quantitative patterns of information confrontation; Prediction of security incidents caused by known and previously unknown cyber-attacks; Preparation of scenarios for deterring a cyber-opposition and planning a response, adequate computer aggression.
In the following sections on this issue, the practice of using big data technologies to organize a streaming process of cybersecurity data, as well as practical questions of semantic Master Data Management (MDM) will be considered for building the SOPCA knowledge base.
The development of a new functional model of a cognitive high performance supercomputer will also be justified, possible prototypes of software and hardware complexes for the early detection and prevention of cyber-attacks will be presented, examples of solutions to classification and regression problems will be given, as will be solutions to the search for associative rules and clustering and possible directions for the development of artificial cognitive cybersecurity systems (Table III).
V.
CONCLUSIONS
The article shares valuable insight gained during the process of designing and constructing open segment prototypesof an early-warning cybersecurity system for critical national infrastructure in the Russian Federation. The results obtained permitted the design of an early-warning cybersecurity system.
In addition, prototypes were developed and tested for software and hardware complexes of stream pre-processing and processing as well as big data storage security, which surpass the well-known solutions based on Cassandra and HBase in terms of performance characteristics.
As such, it became possible, for the first time ever, to
synthesize scenarios of an early-warning cybersecurity system
in cyberspace on extra-large volumes of structured and
unstructured data from a variety of sources: Internet/Intranet
and IoT/IIoT (Big Data and Big Data Analytics) [