The choice of security profile in e-commerce systems depends on the results of the analysis of quantitative and qualitative characteristics of information security risk assessment. The article analyses the concept of information in the aspect of property rights object and investigates threats to information security in electronic commerce systems based on systematic attacks series frequency analysis on the system.
Considering information as an object of protection, it should note that information is the result
of reflection and processing in the human consciousness of the diversity of the surrounding
world [
Therefore, it is very important to solve the problems of creating, using and evaluating the efectiveness of information security systems (GIS) for the designed and existing electronic commerce systems (ECS).
Considering the importance of the information systems protection the following specific feature
should be taken into account [
The model developed shall meet the following requirements [
The value of information is a criterion when making any decision to protect it. Although many diferent attempts have made to formalize this process using information theory and decision analysis methods, the assessment process remains highly subjective. To evaluate, it is necessary to divide the information into categories not only according to its value but also according to its importance. The following is the distribution of information by importance [9]: • Vital, irreplaceable information, the availability of which is necessary for the functioning of the organization; • Important information - information that can be replaced or restored, but the recovery process is very dificult and costly; • Useful information - information that is dificult to retrieve, but an organization can function efectively without it; • Irrelevant information - information that the organization no longer needs.
In practice, attributing information to one of these categories is quite a challenge, since the same information can used by many organizational units, each of which can be assigned to diferent categories of importance. The importance category, as well as the value of information, subsequently changes and depends on the attitude of diferent groups of consumers and potential violators [10]. There are definitions of groups of persons involved in the processing of information: the holder is the organization or the person who owns the information; source the organization or person supplying the information; the ofender is a person or organization who unlawfully seeks information. The attitude of these groups to the significance of the same information may be diferent [11]. Example: • Important online information, such as a list of current week orders and production schedules, can be of high value to the user, while low to the source or ofender; • Personal information, such as medical information, is of much greater value to the source (the person concerned) than to its user or ofender [12]; • The information used by management to develop and make decisions, such as market prospects, may be much more valuable to the ofender than to the source or holder who has already completed the analysis of the data [13].
These categories of importance are noteworthy and can applied to any information. This is also consistent with the existing principle of the distribution of information by level of secrecy. A level of secrecy is an administrative or legislative measure adequate to the extent of a person’s liability for the leakage or loss of specific classified information, which is regulated by a special document taking into account public, military, strategic, commercial, service or private interests. Such information may be state, military, commercial, oficial or personal secret [ 14]. Practice shows that not only secret information is protected. Unauthorized information subject to unauthorized changes (such as modifications to management commands) may result in leakage or loss of classified information associated with it, as well as failure to perform automated system assignments due to erroneous data that may not detected by the system user [15]. The total amount or statistics of non-classified data may be secret as a result. Similarly, aggregate data of one level of secrecy may generally be information of higher secrecy. Functional delimitation of access to information is widely used to protect against such situations. The equal importance, the information processed by the system is shared according to the functional responsibilities and authority of the users. Until recently, information security in automated systems (AUs) is interpreted solely as a risk of unauthorized receipt of information throughout the processing and storage of the AUs. Today, information security is also interpreted as security for actions that use information [16]. The fundamental diferences of the extended interpretation, unlike the traditional one, are very important as computer technology is increasingly used for automated management of information systems and processes in which unauthorized changes to planned algorithms and technologies can have serious consequences. Historically, a traditional property object is a tangible object [17]. Information is not a material object, information is knowledge, that is, the reflection of reality in the mind of man (and the true or false representation is not essential, it is important that it is in the mind). In the future, information can translated into tangible objects of the world. As an intangible object, information is inextricably linked to the material medium [18]. This is the human brain or the alienated material, such as a book, floppy disk, and other types of “memory” (computer memory). From a philosophical point of view, it is possible to speak of information as an abstract substance existing in itself, but for us neither storing nor transmitting information without a tangible medium is impossible [19].
Risk analysis involves the study and systematization of threats to ECS, defining the requirements for security tools for information systems [20, 21]. The analysis clarifies the permissible residual risks and costs of information security measures, and then concludes on the permissible residual risk levels and the feasibility of applying specific security options.
Besides many recent references were dedicated by information security systems issues.
In the Reference [
Authors of the Reference [
The Reference [
The Reference [22] present a Goal-driven Software Development Risk Management Model (GSRM) and its explicit integration into the requirements engineering phase as well as an empirical investigation result of applying GSRM into a project.
The Reference [23] describes the impact of criminal activities based on the nature of the crime, the victims of cybercrime in Internet. Authors proposed to utilize Fuzzy Inference Model (FIS) to produce risk assessment result based on the four risk factors in particular, vulnerability, threat, likelihood and impact as well as specify the range of risks and try to solve such issues.
Based on the hierarchical structure of e-commerce security system, the Reference [24] analyses the security requirements for e-commerce security and proposes a quantitative e-commerce risk assessment model based on cloud computing.
Authors of the Reference [25] designed a model that integrates fault tree analysis, decision theory and fuzzy theory to determine the current causes of cyberattack prevention failures and the vulnerability of a given cybersecurity system. The model was applied to evaluate the cybersecurity risks caused by attacks on a website as well as assess the possible consequences of such attacks.
In the Reference [26] a model, based on the opinions of e-commerce security experts, is designed and implemented by using fuzzy expert systems and MATLAB. A case study is conducted to validate the efectiveness of this model.
In the Reference [27] the data security in the systems of control of passenger flows in Smart City is investigated. The Reference [28] is dedicated by the analysis of DDOS attacks features on the basic machine learning. The Reference [29] describes the measurement instrument for information technology risk assessment towards a risk management strategy.
The Reference [30] explores the internal and external organizational factors and characteristics of information security for afecting the e-commerce systems.
The Reference [31] investigates the evaluation system of E-commerce specialty based on TOPSIS and analytic hierarchy process.
When solving many theoretical and engineering problems, it is often necessary to know the likelihood of a certain number of events occurring in a series. If the risk tests that form a series are considered to independent, then we can make the necessary predictions using the developed hypergeometric law. Consider this a simple example. Let insignificant threats, and each of the events occurred at a certain interval of times list of informational security threats, including dangerous with serious consequences and events be taken from the = 1, , = + ,
= ∑ probabilities of the occurrence of a particular event remain unchanged and are, respectively, /
and / .
A probabilistic threat experiment that operates with the efects of mutually independent trials, in each of which threat events retain their unconditional probabilities, is called repeated sampling. In the implementation of the second scheme, the completed events are considered to non-recurring. The probability of an event occurring in each subsequent trial depends on the results of the previous tests. Thus, we are dealing with dependent tests, and the probability of the result of each test is conditional. An experiment that runs on a sequence of dependent tests, each of which results in conditional probabilities, is called a non-repetitive (or non-return) sample. The real probabilistic threat experiment can carried out either by repeated or repeated sampling [26].
Let the event ′ be that the threat of informational security more than times. Then the probability ( ≤ ≤ ) of this event is will appear at least and not Graphically, the number of additives that need to be calculated can represented as follows = = (Fig. 1):
If the number of terms corresponding to the values of x from a to b is much greater than the total number of terms corresponding to the values of from 0 to − 1 and from − 1 to , then it is more convenient to summarize the probabilities for these two sequences. In this case, we obtain the probability of the opposite event ′ ∶ ( ′ ) = ∑ −=10 Now we calculate the required probability by the formula
− − ∑ = +1
− . ′ −1 =0 ( ≤ ≤ ) = 1 − ( ) = 1 − ∑ − − ∑ Graphically, this approach can interpreted as follows (Fig. 2): some unit of threat A will meet at least a times. Here ( ≥ ) = ∑ If the value of a is small, it is advisable to use the expression ( ≥ ) = 1 − ∑ which is a partial case of formula (3). (3) (4) (5) In the case when = 1 , we have (1 ≤ ≤ ) = 1 − 0 0 = 1 − . summing the probabilities in which the event appears 0, 1, 2, ..., times:
The probability of occurrence of event no more than b times is also determined by ( ≤ ) = ∑ If the value of is close to , then this probability should calculated by the formula: ( ≤ ) = 1 − ∑ which is also a partial case of formula (8). systems in e-commerce systems, there is a constant need to determine the amount of potential threats needed to ensure that information and financial transactions are securely assigned. To do this, let’s first transform the formula
(1 ≤ ≤ ) = 1 − = 1 − (1 − ) by the way (1 − ) = 1 − (1 ≤
≤ ).
We prologarify both parts of equality and after simple transformations we obtain = [1 − (1 ≤ ≤ )] (1 − ) , where indicates the required sample size.
The hypergeometric law can applied only to finite general populations, the volume of which is known. Since in security problems the volume of the general set of attacks is usually not a predictable finite value, the application of this law to predict the results of experiments in unique samples is unrealistic. However, under certain conditions, the hypergeometric probability is well approximated by the binomial probability. Therefore, without fear of violating the mathematical rigor, we will calculate the probabilities of occurrence of event exactly times in our unique sample as if it were a re-sample. In other words, we apply binomial law to unique samples.
We will consider the data of attacks as series or samples, each of which consists of independent tests. The event can appear times in each series ( = 0, 1, 2, ..., ).It is easy to notice that there are groups of series in which appears = 0, 1, 2, ..., that the relative frequency of event is exactly times in one series is determined by the ratio ( ) = / where
is the number of series in which event appears exactly times.
The a priori probability of occurrence of event in one random series is equal to times. It follows and therefore, ≈ ∑
≈ 1 − , .
(9) (10) (11) (12) (13) tionality . exactly times. Because
In the obtained theoretical distribution, each value of is correlated not by its probability, but by some theoretically expected number of series (samples) , in which event appears = ( ) = it is not dificult to notice that the values
and ( ) are related by coeficient of propor
Number of occurrences of the event Empirical frequencies of sampling 0 0 1 1 2 4 3 15 4 33 5 27 6 11 7 4 8 2 9 1 10 0 ∑ = 100
For determine the characteristics of a period of systematic attacks on the ECS was randomly selected 100 time intervals of 10 attacks each. The frequencies of successful attacks in these series are given in Table 1. It is necessary to calculate the theoretical binomial distribution of probabilities of x successful attacks in one series.
Here = 100, = 10. Using the products of and given in the table, we find
Attacks of 9-10 in the series have almost no efect on the result. Therefore, we can neglect them. Here instead of determining, and then summing up the probabilities of 0, 1, 2, ..., 8 attacks (this is nine terms), let’s determine the probability of 9 or 10 attacks (two terms): 10(9) + 10(10) = 0.1493.
Then the required value is calculated by the formula (8)
10( ≤ 8) = 1 − ( 10(9) + 10(10)) = 1 − 0.1493 = 0.8507.
In other words, if we take 10,000 samples of 10 attacks, then in 8507 samples we can expect the appearance of no more than 8 attacks and the greatest load on the security system goes to 2-5 attacks series. By systematizing the statistics of periods of such attacks, it is possible to predict the following system loads and improve security levels in ECS.
The authors developed an approach to the analysis of qualitative (absolute frequency of attacks series on the system per a certain period) and quantitative (relative frequency of attacks series on the system per a certain period) characteristics to assess the information security risks in e-commerce systems. It is proposed to use the method of the sequential monitoring to study information security threats and conduct risk assessments. In this case, the mathematical model of risk, which provides the results of the test for the hypergeometric law, is the basis for the construction of other probabilistic models, including those that are widely used in the study of threats to information security.
Qualitative and quantitative characteristics of one event from a series of attacks are analyzed. The analysis clarifies the priority of information security, allowable residual risks and costs of information security measures. Then it concludes on the allowable residual levels of risk and the feasibility of using the specific security options. It has been experimentally confirmed on 10,000 samples out of 10 attacks that in 8507 samples, no more than 8 attacks can be expected, and the greatest load on the security system falls on 2-5 series of attacks.
In the future, it is expected to investigate the attacks series on information systems depending on period (day, week, month and season). [9] R. Yurynets, Z. Yurynets, D. Dosyn, Y. Kis, Risk assessment technology of crediting with the use of logistic regression model, in: CEUR Workshop Proceedings, volume 2362, 2019. [10] Z. Wu, L. Wang, Trustworthiness measurement of e-commerce systems using fuzzy hybrid multi-criteria analysis, in: 2015 IEEE Trustcom/BigDataSE/ISPA, IEEE, 2015. URL: https://doi.org/10.1109/trustcom.2015.433. doi:10.1109/trustcom.2015.433. [11] A. P. H. de Gusmão, L. C. e Silva, M. M. Silva, T. Poleto, A. P. C. S. Costa, Information security risk analysis model using fuzzy decision theory, International Journal of Information Management 36 (2016) 25–34. URL: https://doi.org/10.1016/j.ijinfomgt.2015.09.003. doi:10. 1016/j.ijinfomgt.2015.09.003. [12] L. Chyrun, I. Turok, I. Dyyak, Information model of the tendering system for large projects, in: CEUR Workshop Proceedings, volume 2604, 2020, pp. 1224–1236. [13] A. Berko, K. Aliekseyeva, Quality evaluation of information resources in web-projects,
Actual Problems of Economics (2012) 226–234. [14] O. Chereshnyuk, V. Panasyuk, S. Sachenko, A. Banasik, I. Golyash, Fuzzy-multiple approach in choosing the optimal term for implementing the innovative project, in: 2017 9th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), IEEE, 2017. URL: https://doi.org/10.1109/ idaacs.2017.8095138. doi:10.1109/idaacs.2017.8095138. [15] V. V. Morozov, O. V. Kalnichenko, O. O. O. M. Mezentseva, The method of interaction modeling on basis of deep learning the neural networks in complex it-projects, International Journal of Computing 19 (2020) 88–96. [16] B. Rusyn, R. Tors’ka, M. Kobasyar, Application of the cellular automata for obtaining pitting images during simulation process of their growth, in: Advances in Intelligent Systems and Computing, Springer International Publishing, 2014, pp. 299–306. URL: https: //doi.org/10.1007/978-3-319-02309-0_32. doi:10.1007/978-3-319-02309-0_32. [17] M. F. Ak, M. Gul, Ahp–topsis integration extended with pythagorean fuzzy sets for information security risk analysis, Complex & Intelligent Systems 5 (2019) 113–126. [18] T. I. Buldakova, D. A. Mikov, Comprehensive approach to information security risk management, in: CEUR Workshop Proceedings, volume 2081, 2017, pp. 21–26. [19] Z. Li, Z. Li, Y. Shen, G. Zhang, Application of combined evaluation method based on comprehensive weight and gray-fuzzy theory in network security risk assessment, in: The International Conference on Computing Technology, Information Security and Risk Management (CTISRM2016), 2016, p. 38. [20] H. D. Tsague, B. Twala, Investigation of carrier mobility degradation efects on mosfet leakage simulations, International Journal of Computing 15 (2016) 237–247. [21] M. Dyvak, N. Porplytsya, V. Brych, N. Halysh, O. Tulai, Y. Shpak, Modeling of dynamics of the company’s share in the solid fuel market, in: 2019 9th International Conference on Advanced Computer Information Technologies (ACIT), IEEE, 2019. URL: https://doi.org/ 10.1109/acitt.2019.8779973. doi:10.1109/acitt.2019.8779973. [22] S. Islam, H. Mouratidis, E. R. Weippl, An empirical study on the implementation and evaluation of a goal-driven software development risk management model, Information and Software Technology 56 (2014) 117–133. URL: https://doi.org/10.1016/j.infsof.2013.06.003. doi:10.1016/j.infsof.2013.06.003. [23] M. Alali, A. Almogren, M. M. Hassan, I. A. Rassan, M. Z. A. Bhuiyan, Improving risk