Cybersecurity as a relatively new science covers quite a large number of areas, most of which are still in their infancy. The basis of cybersecurity, like any exact science, is mathematics. But the non-stationary and at the same time nonlinear nature of phenomena and processes occurring in cyberspace places special requirements on the mathematical tools used in cybersecurity. On the one hand, it should be adapted as much as possible for solving specialized problems, on the other hand, such mathematical tools should describe the phenomena and processes that are being studied quite fully and adequately. Today, in the field of cybersecurity, mathematical tools based on set theories, graphs, logic, probabilities, etc. are widely used. A special place in this field today is given to data mining, simulation, situational and cognitive modeling, parametric and structural synthesis of information security systems. The article develops the idea of applying in the field of cybersecurity the well-known mathematical apparatus of differential transformations of Academician of the National Academy of Sciences of Ukraine G. Pukhov, which has already found wide application in other branches of science and technology-electronics, electrical engineering, mechanics, chemical technologies, space research, etc. For this purpose, examples of the use of differential transformations for constructing models of cyberattack patterns for attack detection systems, mathematical models for assessing the level of security of information and telecommunications systems from zeroday cyberattacks by security analysis systems, and for building new cryptographic systems are given. The prospects for applying differential transformations to study the processes of interaction in social networks, as an example of sociotechnical cybernetic systems, are shown.
Differential transformations of Academician of the National Academy of Sciences of Ukraine G. E. Pukhov [1] have now become an effective tool for studying nonlinear and non-stationary processes in many branches of Science and technology. One of the first applied applications of differential transformations was their use for solving electrical engineering problems [1]. Over time, differential transformations began to be used to solve problems in radio engineering [2], mechanics [3], heat engineering [4], optimal control [5], computer engineering [6], and Space Research [7]. Such a wide range of applications of differential transformations is due to their significant advantages over the known LaPlace, Fourier, Mellin, and Taylor-Cauchy integral transformations. The main advantage of differential transformations over the integral transformations mentioned above is the possibility of their application for the correct solution of nonlinear problems described by a fairly wide class of systems of Integral and differential equations [1].
In the field of cybersecurity, as is known [8], most of the phenomena and processes that occur in information security systems are nonstationary. Many of them can be described and are already described by systems of linear and nonlinear inhomogeneous differential equations. For example, today models of various malicious software samples such as SIS, SIR, SAIR, PSIDR, described by systems of differential equations, are widely known [8]. Some processes, such as the encryption process for a new type of symmetric cryptosystems, are described by Integral Equations [9].
Therefore, given the prospects of differential transformations as a modern mathematical tool, it is considered appropriate to expand the scope of its application in the interests of Applied Solutions to cybersecurity problems.
For the first time, the use of differential transformations for solving cybersecurity problems was proposed in [10]. Their main purpose was to solve linear and nonlinear inhomogeneous systems of differential equations that describe the processes of attacking information in information security systems. During 2009-2010, the theoretical foundations of modeling the processes of attack on information and its protection based on differential transformations were developed. The result of the research was the publication of the corresponding monograph [11]. Over time, differential transformations found a place in the creation of symmetric cryptosystems [12] and began to be used to construct patterns of potentially dangerous cyber attacks [13]. There is still no unified vision of the role and place of differential transformation in the field of cybersecurity.
The purpose of the article is to systematize the well-known areas of application of differential transformations of Academician of the National Academy of Sciences of Ukraine G. E. Pukhov in the field of cybersecurity and determine further promising ways of their implementation in this industry.
The essence and content of differential transformations are described in the works of their author, for example in [1] and others. let's consider an example of their application for differential game modeling of cyberattack processes [10, 14].
Example. Let the change in cybersecurity States in a computer network be described by a graph model (fig. 1).
P0(t0) 0 P0(t)
Pz (t ) – probabilities of a computer network being in one of the cybersecurity states z = 0, c at some point in time t ;
Pz (t0 ) – zero initial conditions when a computer network is in one of the cybersecurity states z = 0, c at a time t0 ;
z – intensity of recovery streams of infected hosts on the computer network, z = 0, c ; z – intensity of streams infection of hosts in the computer network with malware, z = 0, c .
Circles on fig. 1 indicates the cybersecurity States in which the computer network may be located. Above the transition Arrows are the corresponding flow intensities that put the network in the corresponding states.
According to the above example (see fig. 1) it is necessary to build a differential game model of the cyberattack process on a computer network and assess its level of security under the accepted conditions.
Solving the example. Let's make a system of Kolmogorov-Chapman differential equations. The number of equations in a given system is determined by the number of states in which a computer network can be located (see fig. 1). The following general rule should be followed when compiling the system:
on the left side of each equation of the system is the derivative of the probability of a certain ( z -th) state;
on the right - the sum of the products of the probabilities of all states from which the arrows enter this state, on the intensity of the corresponding information flows, minus the total intensity of all flows that bring the system out of this state, multiplied by the probability of this ( z -th) state.
Based on the above rule we have d P0 (t ) d t d P2 (t ) d t d Pc (t ) d t = −3 0 P0 (t ) + 0 ( P1 (t ) +
+P2 (t ) + P3 (t )); = − (0 + 1 ) P1 (t ) +
+ 0 P0 (t ); = − 3 c P0 (t ) +c ( Pz (t ) +
+Pc−2 (t ) + Pc−1 (t )).
Let us impose additional (initial) conditions on
System (
P0 (t0 ) = 1 , P2 (t0 ) = = Pc (t0 ) = 0 , we will also define the rationing conditions P0 (t0 ) + P2 (t0 ) +
+ Pc (t0 ) = 1.
In the differential game setting [11], the
intensity of flows z and z are called
strategies of players of cyber attack and cyber
defense, respectively, and are limited in their
boundaries
0 z z max ,
0 z z max ,
(
Using the method of differential
transformations [1], we obtain a spectral model of
cybersecurity states
T
P0 ( k + 1) = −3 0 P0 ( k ) +
k + 1
+ 0 ( P1 ( k ) + P2 ( k ) + P3 ( k ) ) ;
T
P1 ( k + 1) = − (0 + 1 ) P1 ( k ) +
k + 1
+ + 0 P0 ( k ) ;
T
Pc ( k + 1) = −3 c P0 ( k ) +
k + 1
+c ( Pz ( k ) + Pc−2 ( k ) + Pc−1 ( k ) ) .
(
When receiving the system (
Assigning sequentially integer values to the
argument k =: 0, 1, according to the spectral
Model (
P0 (0) = P0 (t0 ) = 1 , P0 (
Let's find the best strategies for allocating players resources zopt і zopt , game price I (level of protection of the computer network from the malware) and, in fact, the model P0 (t ) itself, which is the trajectory of the game.
To do this, we will present the board I with a general integral model
I =
t0
T
1 T
P0 (t ) dt .
(
To find optimal strategies 0opt and 0opt
allocate available resources (
The necessary conditions for the existence of
the extremum of the functional I ( 0 , 0 ) (
= 0 ; = 0.
→ 0opt ; 0opt .
Sufficient conditions for the existence of the
extremum of functional I ( 0 , 0 ) (
0 ; 0.
→ 0omptin ; 0opmtax .
Fulfilling the condition of existence saddle point : where 0 ,
2 2 I1 ( 0 , 0 ) − =
0 0 2 I1 ( 0 , 0 ) 2 I1 ( 0 , 0 ) −
02 02
indicates that it is inappropriate for players to
deviate from their optimal strategies (
I (t, P0opt (t ), 0 , 0omptax ) min I (t, P0 (t ), 0 , 0omptax ), E
I (t, P0opt (t ), 0omptin ,0 ) max I (t, P0 (t ), 0omptin , 0 ).
E
So, if there is a saddle point (
When moving to the time domain using the
inverse transformation [1], the trajectory of a
differential game-a differential game model of the
cyberattack process on a computer network
Popt (t ) , provided that players choose optimal
0
strategies (
k = t k P0opt (t ) = P0opt ( k ) .
k =0 H In all other cases –
k = t k P0 (t ) = P0 ( k ) .
k =0 H
(
Thus, the given example shows the potential possibilities of using differential transformations in modeling cyberattack processes on computer systems and networks in the case of describing malicious software samples by systems of differential equations.
The article provides an overview of one of the examples of using differential transformations to solve cybersecurity problems. After analyzing other well-known examples of the use of differential transformations [15] in conclusion, we note that they can also be used to solve problems in cryptology.
Thanks to professors Vladimir Baranov, Vladimir Khoroshko and Alexander Korchenko introduction to differential transformations and cybersecurity.