The structural solution of the real-time information security risks assessment system is developed, which, due to the structural components of the subsystems of primary and secondary data generation, as well as their components of input data initialization modules, formation and conversion of reference values, weighing evaluation parameters and their adjustment, evaluation of risk degree and report generation, in which the proposed method is implemented, allows to provide certain properties of adaptability and efficiency in risks assessment in real time.
Often in the risks analysis and assessment (RAA) it is not always possible to involve relevant specialists, and there are situations in which the expert can not always unambiguously assess a particular vulnerability of information systems resources (ISR). It is proposed to use appropriate databases (DB) of vulnerabilities (in which their quantitative estimates are presented), such as the National Vulnerability Database (NVD), Open Sourced Vulnerability Database (OSVDB), IBM X-Force, US-CERT VND, SecurityFocus and etc.
The basic component of such databases is CVSS - indicators that can be used as an alternative to expert estimates.
In practice, for example, there may be situations where it is necessary to carry out operational assessment and monitoring (realtime) of risks without the involvement of these experts, and the available methods and tools of RA do not provide such an opportunity.
Let’s consider in details its work, which is based on 11 steps.
Step 1 (Determining the complete set of RIS identifiers and vulnerabilities)
The first step determines the complete set of identifiers of all RIS, ie
r RIS = {
RISrs} (rs = 1, r) , rs=1 where r – the number of all resources (and, accordingly, their identifiers), as well as the full set of vulnerabilities
n V = {
Vuz} (uz = 1, n) , uz=1 where n – the number of all vulnerabilities (and, accordingly, their identifiers). Based on and experts can identify sets of RIS and vulnerabilities by object of assessment. To create appropriate sets (as a basis), for example, a known database of NVD vulnerabilities can be used.
Step 2 (Determining the set of RIS identifiers and vulnerabilities for the object of evaluation)
Here, based on the set RIS for a specific object of evaluation, experts determine the required set of RIS (and, accordingly, their identifiers) RISO (RISO RIS) , that is
ro
RISOrs} (rs = 1, ro), rs=1 where ro – the number of assessed RIS at the facility. Next for every RISOrs the sets of their vulnerabilities are determined Vrs V accordingly, their identifiers), ie ro ro nrs
(and,
Vrs,uz}} (rs = 1, ro, { rs=1
Vrs} = { rs =1, ro and uz = 1, nrs , ie
ro ro nrs { LRVrs} = { { LRVrs,uz}} ,
rs=1 rs=1 uz=1 where LRVrs,uz – quantitative risk assessment for each uz-th vulnerability of rs-th РІС on yhe object. To display the result of the RA, we will use the LV "RISK DEGREE" (RD), presented in the form of a tuple.
Further, to ensure the evaluation process,
indicators are taken as a basis CVSS [
g EP = {
EPi} = {EP1, EP2 ,..., EPg } , where g – i=1 the number of sets of such parameters.
Note that for version 3 estimations of CVSS
[
EPi} = EP1, EP2 , EP3 ={ B, T , E }
(i = 1,3 ) , {
i=1 where:
nrs
B – basic (Base) estimations, which are presented as a set
B = {
Buz} (uz = 1, nrs ) , AVuz = { av=1
uz=1 whose members are formed on the basis of a group of sets of parameters AVuz , ACuz , PRuz , Suz , UIuz , Cuz , Iuz , Auz (uz = 1, nrs ), where:
AVuz – cyber-attack vector, which is represented as a set 4
AVuz,av} = AVuz,1, ..., AVuz,4 = N , A, L, P (uz = 1, nrs , av = 1, 4) , where: N – «Network» = 0,85; A – «Connected network» = 0,62; L – «Local access» = 0,55; P – «Physical access» = 0,2,
ACuz – the complexity of the cyber-attack, represented by the set
2 ACuz = {
ACuz,ac} = ACuz,1, ACuz,2 ac=1
= L, H (uz = 1, nrs , ac = 1, 2) , where: L – «Low» = 0,77; H – «High» = 0,44,
PRuz – compliance with the authority represented by the plural PRuz = {
PRuz, pr } = {PRuz,1, PRuz,2 ,
PRuz,3} = N , L, H (uz = 1, nrs , pr = 1,3) , where: N – «Absent» = 0,85;
0,62 at Suz,1 = U , L – «Low» = 0,68 at Suz,2 = C, with 2 s=1 ui=1
c=1
Suz – action scope, which can be represented as a set
Suz = {
Suz,s} = Suz,1, Suz,2 = U , C (uz = 1, nrs , s = 1, 2) , where: U – «No changes»; С – «Changing»);
0, 27 at Suz,1 = U , H – «High» = 0,50 at Suz,2 = C, UIuz = { UIuz – user interaction, represented by the set 2
UIuz,ui} = UIuz,1, UIuz,2 = N , R (uz = 1, nrs , ui = 1, 2) , where: N – «No need» = 0,85; R – «Is required» = 0,62,
Cuz – impact on privacy, defined as a set
3 Cuz = {
Cuz,c} = {Cuz,1, Cuz,2 , Cuz,3} =
N , L, H (uz = 1, nrs , c = 1,3) , where: N – «Absent» = 0; L – «Low» = 0,22; H – «High» = 0,56,
Iuz – influence on integrity, which is represented by the set
3 Iuz = {
Iuz,in} = {Iuz,1, Iuz,2 , Iuz,3} in=1
= N , L, H (uz = 1, nrs , in = 1,3) , where: N – «Absent» = 0; L – «Low» = 0,22; H – «High» = 0,56,
Auz – the impact on availability, which can be represented by the plural
3 Auz = {
Auz,ai} = {Auz,1, Auz,2 , Auz,3} = ai=1
N , L, H, (uz = 1, nrs , ai = 1,3) , where: N – «Absent» = 0; L – «Low» = 0,22; H – «High» = 0,56;
Т – temporal estimates, which in accordance with paragraph 4.6 are presented as a set nrs sets set
T = {
Tuz} (uz = 1, nrs ) , uz=1 whose members are determined by a group of
of parameters: EXuz , RLuz , RCuz (uz = 1, nrs ), where:
EXuz – usability, which can be displayed as a
5 ex=1 EXuz = {
EXuz,ex} = EX uz,1, ..., EX uz,5 = X , U , POC, F, H (uz = 1, nrs , ex = 1,5) , where: Х – «No data» = 1; U – «Theoretical (no evidence)» = 0,91; POС – «Experimental» = 0,94; F – «Functional» = 0,97; H – «High» = 1,
RLuz – the level of correction (indicator of the degree of readiness of the decision), which is determined as a set
5 RLuz = {
RLuz,rl } = RLuz,1, ..., RLuz,5 = rl=1 {X ,OF, TF, W , U} RCuz = {
rc=1 (uz = 1, nrs , rl = 1,5), where: Х – «No data» = 1; OF – «Official patch» = 0,95; TF – «Interim solution» = 0,96; W – «Solutions based on tips and tricks» = 0,97; U – «Absent» = 1,
RCuz – the reliability of the report (an indicator of the degree of reliability of information), which is represented by the set 4
RCuz,rc} = RCuz,1, ..., RCuz,4 = {X , U , R, C} (uz = 1, nrs , rc = 1, 4), where: Х – «No data» = 1; U – «Undefined» = 0,92; R – «Justified» = 0,96; C – «Confirmed» = 1;
Е – environmental metrics (Environmental), presented as a set
nrs E = {
Euz} (uz = 1, nrs ), uz=1 whose members are determined by a group of sets of parameters: CRuz , IRuz , ARuz , MSuz , MAVuz , MACuz , MPRuz , MUIuz , MCuz , MIuz , MAuz (uz = 1, nrs ), where:
CRuz – confidentiality requirements defined as a set
CRuz = {
CRuz,cr } = CRuz,1, ..., CRuz,4 = 4 cr=1 X , L, M , H (uz = 1, nrs , cr = 1, 4), where: Х – «Undefined» = 1; L – «Low» = 0,5; M – «Medium» = 1; H – «High» = 1,5,
IRuz – integrity requirements represented by the set
IRuz = {
IRuz,ir } = {IRuz,1, ..., IRuz,4} = 4 ir=1
X , L, M , H (uz = 1, nrs , ir = 1, 4), where: Х – «Undefined» = 1; L – «Low» = 0,5; M – «Medium»= 1; H – «High» = 1,5,
ARuz – accessibility requirements, presented in the form of a set
4 ARuz = { ar=1
ARuz,ar } = ARuz,1, ..., ARuz,4 = X , L, M , H (uz = 1, nrs , ar = 1, 4), where: Х
– «Undefined» = 1; L – «Low» = 0,5; M – «Medium» = 1; H – «High» = 1,5,
MSuz – modified action scope, which can be represented as a set
MSuz = {
MSuz,ms} 3 ms=1 = MSuz,1, MSuz,2 , MSuz,3 = X , U , C (uz = 1, nrs , ms = 1,3),
Medium = MAVuz,1, ..., MAVuz,5 =
X , N , A, L, P (uz = 1, nrs , mav = 1,5) , where: Х – «Undefined» = 1; N – «Network» = 0,85; A – «Connected network» = 0,62; L – «Local access» = 0,55; P – «Physical access» = 0,2,
MACuz – modified complexity
of a cyberattack determined by the set
3 MACuz = {
MACuz,mac}= mac=1 MACuz,1, MACuz,2 , MACuz,3 = X , L, H
(uz = 1, nrs , mac = 1,3) , where: Х – «Undefined» = 1; L – «Low» = 0,77; H – «High» = 0,44,
MPRuz – modified compliance with the authority represented by the set
4 MPRuz = {
MPRuz,mpr } = mpr=1 {MPRuz,1, MPRuz,2 , MPRuz,3, MPRuz,4 (uz = 1, nrs , mpr = 1, 4) , } = X , N , L, H where: Х
– «Undefined» = 1; N – «Absent» = 0,85;
0, 62 at MSuz,1 = U , L – «Low» = 0, 68 at MSuz,2 = C; 0, 27 at MSuz,1 = U , H – «High» =
0, 50 at MSuz,2 = C,
MUIuz – modified interaction with the user, represented by the set
3 mui=1 MUIuz = {
MUIuz,mui} = MUIuz,1, MUIuz,2 , MUIuz,3 = X , N , R 5 mav=1
4 mc=1 (uz = 1, nrs , mui = 1, 2) , where: Х
– «Undefined» = 1; N – «No need» = 0,85; R – «There is a need» = 0,62,
MCuz – modified impact on privacy determ MAVuz = {
MAVuz,mav} ined by the set MCuz = {
MCuz,mc} = {MCuz,1, MCuz,2 ,
MCuz,3 , MCuz,4} = X , N , L, H
MIuz determined by the set
4
(uz = 1, nrs , mc = 1, 4) ,
[
m sets are initialized by m-terms T T ~ KEPi = j=1~KEPi j
, for which, respectively, determine their intervals of values for each EPi , (i = 1, g) – [kEPi1 ; kEPi 2 [, [ kEPi 2 ; kEPi 3 [, …, [ kEPi j−1 ; kEPi j [, [kEPi j ; kEPi j+1[, …, [ kEPim ; kEPi m+1 ].
Next, using the appropriate method [
To do this, we modify the expression of the
method using the following redefinitions [
Significance assessment of EPi is performed using parameters from the set LS {LSi} (i = 1, g) , and estimation of the current value of the estimation parameter – by means of set ep {epuz,i} (uz = 1, nrs , i = 1, g) .
Step 4 (Determining the number of term sets)
The number of term sets that will be used in
the RA process is determined. If necessary, the
initial number of term sets can be changed. For
this purpose, for the equivalent transformation of
m-dimensional terms of FN LV DR(m) in DR(m-n)
or DR(m+n) and K E(mPi) in K E(mPi−n) or K E(mPi+n) it is
proposed to use methods of realization of function
of transformation of LV standards [
Step 5 (Assessment of the evaluation
parameters significance level). This step is
interrelated with a similar step of the method
described in [
Step 6 (Determination of reference values of the risk degree).
In this step, the reference values for LV DR are determined, that is, the number of terms in the base term set is specified T~ DR , where they correspond to a given range of values in the range from drmin to drmax.
Step 7 (Determination of evaluation parameters reference values).
Experts determine the standards of parameters for LV KEPi , that is, the number of terms in the term set T~ KEPi is specified.
To convert intervals into FN, we use the
method proposed in [
The value of each of the parameters can be this method. Here Euz is a corrective evaluation
taken from known databases or determined by parameter that determines Buz and Tuz .
appropriate formulas [
IRuz,ir , MAuz,mai , ARuz,ar pre-defined in step 3 of where roundUp1 ( ) – function for rounding to the first decimal place (for example, 3,822 will be rounded to 3.8); 6, 42ISCuz at Suz,1 = U , 7,52(ISCuz − 0, 029) − IMuz = −3, 25(ISCuz − 0, 02)15
at Suz,2 = C, where ISCuz = 1 − ((1 − Cuz,c )(1 − Iuz,in )(1 − Auz,ai )) , values Suz,s , Cuz,c , Iuz,in , Auz,ai we obtain on the basis of step 3 of this method, and
EXbuz = 8, 22AVuz,av ACuz,ac PRuz, prUIuz,ui ,
Tuz = roundUp1(Buz EXuz,ex RLuz,rl RCuz,rc ) , where the values EXuz,ex , RLuz,rl і RCuz,rc also obtained on the basis of step 3 of the method; 0 at MIMuz 0, roundUp1(min[(MIMuz + MEXbuz ) EX uz,ex RLuz,rl RCuz,rc , 10]) Euz = at MSuz,1 = U , roundUp1(min[1, 08(MIMuz + MEXbuz ) EX uz RLuz,rl RCuz,rc , 10]) at MSuz,1 = C, where: 6, 42(MISCuz ) at MSuz,1 = U , 7,52(MISCuz − 0, 029) − MIMuz = −3, 25(MISCuz − 0, 02)15
а at MSuz,2 = C, MEXbuz = 8, 22MAVuz,mav MACuz,mac
MISCuz = min[(1− (1− MCuz,mcCRuz,cr ) (1− MIuz,minIRuz,ir ) (1− MAuz,mai ARuz,ar )), 0,915] , T~KEPi j .
Vrs,uz .
EPi EP1 … EPi … EPg
Similar transformations are carried out for all
λuz,ij for T~KEPi j ( uz = 1, nrs , i = 1, g , Step 10 (Risk degree assessment)
This step calculates the risk indicators for each vulnerability reflected by the identifier Vrs,uz
Klrj = according to the formula
m g LRVrs,uz = Klrj i=1 (ks LSi )λuz,ij ,
j=1 where 90 – 20(m – j), ks =
1 (LS1 + ... + LSi )
– rationing factor, λuz,ij (uz = 1, nrs , i = 1, g , j = 1, m, ) determined for each
Vrs,uz (rs = 1, ro, uz = 1, nrs ) , and LSi, (i = 1, g) depending on the significance of the parameter.
Step 11 (Formation of a structured risk parameter)
Based on the calculated value of LRVrs,uz and constructed standards form a structured parameter of the risk degree RD by expression: (LRVrs,uz ; T~ DRj ) at j (LRVrs,uz ) = 1; SPuz = (LRVrs,uz ; T~ DRj ( j (LRVrs,uz )); T~ DRj+1 ( j+1(LRVrs,uz ))) at j (LRVrs,uz ) 1 j+1(LRVrs,uz ) 1, where (LRVrs,uz ; T~ DRj ) verbally interpreted as – «The risk degree T~ DRj with a numerical equivalent
and (LRVrs,uz ; T~ DRj ( j (LRVrs,uz )); T~ DRj+1 ( j+1(LRVrs,uz ))) , as – «The risk degree with a numerical equivalent LRVrs,uz , which borders T~ DRj and T~ DRj+1 along the border
T~ DRj – j+1(LRVrs,uz ) ».
j (LRVrs,uz ) and
T~ DRj+1 –
With the help of RD both the numerical value of the degree of risk and its linguistic interpretation can be obtained.
Also, can be calculated the average value LRrs by estimation resource:
nrs LRrs = ( LRVrs,uz ) / nrs .
uz=1
Thus, the presented method of assessing the risks of IS based on open database vulnerabilities by modifying the procedures for determining the set of RA parameters and estimating the current values of parameters with the possibility of integration (as an alternative to expert estimates) of CVSS values (version 3.0) presented in NVD distinguish between vulnerable and offensive components, and also allows for the implementation of operational assessment and monitoring (real-time) of risks without the involvement of experts in the relevant subject area.
On the basis of the developed method the
corresponding system of IS RA which due to use
of structural components of subsystems of
formation of primary and secondary data, and also
components of their modules of initialization of
input data, formation and transformation of
reference values, weighing of estimation
parameters and their adjustment, estimation of RD
and generation of report, which implemented the
proposed method, allows to provide certain
properties of adaptability and efficiency in RA of
RIS security in real time. Such a system, using
CVSS metrics, allows to perform RA in real time,
as well as at the request of the user to transform
the reference LV without the involvement of
specialists in the relevant field. In addition, the
system provides the function of editing these
metrics, using the built-in CVSS-calculator
version 3.0 [
The structural solution of the proposed system (Fig. 1) consists of two basic components that reflect the subsystems of primary (SPDP) and secondary data (SSDP) processing. We describe the composition of each of the subsystems.
The SPDP subsystem is intended for primary processing of initial values and includes the module of input data initialization (MDI), and also modules of formation (MFR) and conversion (MCR) of reference values.
The SSDP subsystem, using CVSS metrics, performs the transformation of the primary parameters coming from the SPDP in order to form the final estimates of the RD. It consists of a module for weighing evaluation parameters (MWP) and their adjustment (MAP), as well as modules for estimating RD (MRD) and generating a report (MGR).
Let’s consider the functional purpose of each
of the modules of the subsystems. Thus, MDI is
designed to form and identify many RIS and
vulnerabilities of the evaluation object [
Here based on the set RIS for the specified object experts determine the required set of RIS (and, accordingly, their identifiers) ro
RISOrs} (rs = 1, ro), where ro – the
Vrs,uz}} (rs = 1, ro, uz = 1, nrs ), where { ro nrs
{ rs=1 uz=1 nrs – the possible number of identified vulnerabilities of rs -th estimated RIS ( RISOrs ) .
As input for the MDI can be used, for example, the results of the program to check the system for penetration (Penetration test).
Such software, as a rule, analyzes the specified object, searching for vulnerabilities of its RIS in cyberspace (according to ISO / IEC 27032: 2012, cyberspace can be understood as a complex entity that actually exists as a global set of processes of interaction of people, software and Internet services in networks (including technological equipment connected to them), but which does not manifest itself in any known, material form).
Thus, a list is formed in the form of a set of RIS vulnerabilities of the studied object. To obtain a set of RIS and a set of relevant vulnerabilities in MDI, performed the processing of the corresponding report obtained from specialized software (level - Penetration test), which contains information about RIS and vulnerabilities with the specified CVSS metrics.
Next, the list of vulnerabilities and RIS is initialized for further transmission to the MFR. As a result of the work of the MDI, all identified MFRs arrive at the entrance RISOrs , Vrs and their CVSS metrics. Next, the MFR performs the formation of a set of parameters: ro −
LR = {
LRrs } (rs = 1, ro) , where rs=1 LRrs – quantitative risk assessment of rs − th RIS on object (used for RISOrs ); where LRVrs,uz – quantitative risk assessment for each uz − th vulnerability of rs − th RIS on the object (used for the RA for each vulnerability reflected by the identifier Vrs,uz );
DR, where LV «RISK DEGREE» is represented as a corresponding tuple <DR, T~ DR , XDR> (is used to display the RA result);
g EP = {
EPi } (i = 1, g ) , where g – K EPi ,
i=1 number of sets of evaluation parameters (used to ensure the evaluation process, based on CVSS indicators);
− where LV «LEVEL OF EVALUATION
PARAMETER
EPi » determined by the tuple < K EPi , T~KEPi , X EPi > (used to display evaluation results using CVSS metrics).
Formed LVs DR and K EPi are transmitted to the input of the MCR, where for each of the terms T ~ DR1 ,…, T ~ DRj ,…, T~ DRm і T~KEPi1 , T~KEPi 2 ,…, T~KEPi j−1 , implemented according to the specified range of values [dr1; dr2[, …, [drj; drj+1[,…, [drm; drm+1] і [kEPi1 ; kEPi 2 [, [ kEPi 2 ; kEPi 3 [, …, [ kEPi j−1 ; kEPi j [, [kEPi j ; LRV = { rs=1
LRVrs } = LRVrs,uz }} (rs = 1, ro, kEPi j+1[, …, [ kEPim ; kEPi m+1 ] to FN. Also in MCR the procedure of variation by the order of LV is implemented. Thus, for the equivalent transformation of m-dimensional terms of FN LV DR(m) to DR(m–n) or DR(m+n) and K E(mPi) to K E(mPi−n) or K E(mPi+n) in MCR methods of transformation of LV standards are used. As a result of transformations on output of SPDP arrive RISOrs , Vrs and their CVSS metrics, EРi, LV DR and K EPi , as well as formed sets LR і LRVrs for RA.
Significance levels of estimation parameters are defined in MWP SSDP LSi (i = 1, g ) and their current values epuz,i to a given FN, after which values λuz,ij are formed. Also in MWP the graphic interpretation of estimation parameters is carried out B, T and E.
If necessary, it is possible to adjust the CVSS metrics using the MAP, which implements their redefinition due to the built-in CVSS-calculator (see Fig. 2). Adjusted parameters B’, T’ and E’ are transferred back to the MWP.
Data from MWP LSi , epuz,i and λuz,ij enter the MSP, where for each vulnerability reflected by the identifier Vrs,uz , SR evaluation is implemented LRVrs,uz , and the average value is calculated LRrs for RIS. Next, based on the calculated value LRVrs,uz , LRrs and constructed standards in the SPDP, the process of defasification, which is associated with the formation of a structured parameter of the RD SPuz , which allows to obtain numerical values of RD and its linguistic interpretation.
On the basis of MGR, taking into account the results of SPDP and SSDP, a report is generated on the estimates of the RD (see Fig. 3), which contains RISOrs , Vrs , LRVrs,uz , LRrs , their linguistic equivalents and graphical interpretation of the results. The proposed real-time IS RA system, for example, can be implemented programmatically and work on the basis of the proposed basic algorithm (Fig. 4).
According to this algorithm, the operation of the system begins with the initialization of the list of vulnerabilities and CVSS ratings (top 1) using a specialized program to check the system for penetration (Penetration test).
This procedure in the software implementation can, for example, be performed by the function OpenXMLFile (), which opens the file in XML format and implements its parsing. XML file parsing is used to initialize (fill in) fields in the Vulnerability class with the following structure: }}.
After identifying the next vulnerability (Vulnerability class), its characteristics are entered into the List container, resulting in the formation of a structure – List <Vulnerability>. Next, after generating a list of vulnerabilities (vertex 2), its contents are written to the ListBox component with RISOrs , Vrs and their CVSS estimates.
Next, in the loop (vertex 3) performs a selection of vulnerabilities (vertex 4) from the ListBox (Select Vul) and their graphical interpretation (vertex 5) CVSS metrics (Fig. 2). This process provides the appropriate event handler - the lbVul CVSS_ SelectedIndexChanged function. The moment the SelectedIndexChanged event occurs when the index of the selected ListBox component changes. The lbVulCVSS_SelectedIndexChanged function graphically displays CVSS metrics based on the LiveChart library. CVSS metrics are displayed in the form of a bar chart (see Fig. 2), which is achieved using the following block of program listing: сhartCVSS.Series.Add(new ColumnSeries() {
Title = vulList[lb.SelectedIndex].Description,
Values = new ChartValues<ObservableValue>() {
new ObservableValue(vulList[lb.SelectedIndex].metri cs.baseVector.CommonScore),
new ObservableValue(vulList[lb.SelectedIndex].metri cs.tempVector.CommonScore),
new ObservableValue(vulList[lb.SelectedIndex].metri cs.envirVector.CommonScore) },
DataLabels = true});
Next, with the help of a predetermined process (vertex 6) is the formation of LV K EPi and DR, and sets are initialized for subsequent estimates LR and LRVrs .
After the formation of the necessary linguistic terms, the conversion of the given intervals into FN is performed, linguistic standards are formed and their graphical interpretation is realized (vertex 7). For clarity, the obtained CVSS metrics for each vulnerability are displayed on a graph with reference values EРi (see Fig. 5).
Representation of terms of LV in K EPi graphical form (in accordance with the software implementation of the system) is provided by the structure of TrapezeCreator, which may have, for example, such fields: struct Trapeze { public string degreeRisk; public double a { get; set; } public double b11 { get; set; } public double b21 { get; set; } public double c { get; set; } }.
The intervals that will be used to convert to FN are described by the Interval structure, which consists of the following fields: struct Interval { }.
public double a { get; set; } public double b { get; set; }
Graphical interpretation of the obtained results
(according to the proposed software
implementation) is carried out using the function
List <Trapeze> CreateTrapezeList (double
lengthAsixX, int countTrap, params double
intervalArr) [
Initialization of a new interval in the program is realized by means of the following block of program listing (verses 8-9):
Double interval = new
double[intervalList.Count * 2] [
for (int i = 0, k = 0; i < interval.Length; i++, k++) { interval[i] = intervalList[k].a; interval[++i] = intervalList[k].b;}.
Intervals are formed from a pre-formed list of intervalList, having the type List <Interval>, and are filled using the following block of program listing:
private void bSetInterval_Click(object sender, EventArgs e) { string[] arrInterval = interval.Split(':'); double a = Convert.ToDouble(arrInterval[0]);
double b =
Convert.ToDouble(arrInterval[
intervalList.Add(new Interval() { a = a, b = b });}.
The procedure of incrementing (vertices 1011) or decrementing (vertices 12-13) can be carried out, for example, using the developed functions List <Trapeze> IncrementTrapezeList (List <Trapeze> trapList, double lengthAsixX) or List <Trapeze> DecrementTrapezeList (List <Trapeze > trapList, double lengthAsixX).
On the basis of the received CVSS metrics the estimation (top 14) is realized LSi and classification of λuz,ij obtained epuz,i (fasification).
If necessary (vertex 15) CVSS metrics are adjusted B, T and E (vertex 16). Next, using the data obtained LSi and λuz,ij , estimated RD
(vertex 17) for each vulnerability reflected by the identifier Vrs,uz , and the average value is calculated LRrs . Here, based on the received
and constructed standards in the PDP, the structured parameter RD is formed SPuz (dephasification).
As a result of the calculations performed by the method of IS RA (vertex 18) a report is formed on the estimates of the RD (Fig. 6), which contains RISOrs , Vrs , LRVrs,uz , LRrs , their linguistic equivalents, as well as a graphical interpretation (vertex 19) of the results (Fig. 3). To verify the work of the developed software (see Fig. 6), a corresponding experimental study was conducted.
To test the object of assessment for penetration used software to test the system for vulnerabilities - "Netsparker" (Fig. 7). As a result of scanning the XML file with the list of RIS and their vulnerabilities (fig. 8) was formed for the further use as input data of the developed system of IS RA.
Based on the obtained information about the assessment components and vulnerabilities, the system implements the calculation (vertex 17) of the RD for each vulnerability and with the help of a subprogram (vertex 18) that implements the functions of the MGR, performs a graphical interpretation of the vulnerability of the LV DR at m=4 (see Fig. 11). All the obtained results are recorded in the report generated by MGR.
Thus, the structural solution of the real-time IS RA system is developed, which, due to the structural components of the subsystems of primary and secondary data generation, as well as their components of input data initialization modules, formation and conversion of reference values, weighing evaluation parameters and their adjustment, evaluation of RD and report generation, in which the proposed method is implemented, allows to provide certain properties of adaptability and efficiency in RA security of RIS in real time.
Also on the basis of the offered structural decision the basic algorithm and the corresponding software for estimation in the form of application software system of RA which unlike known uses values of CVSS (versions 2.0 and 3.0) of the indicators presented in the corresponding databases and allows real-time risk assessment of RIS security.