In [1,2] the architecture of a promising fuzzy intelligent system for detecting cyber attacks was proposed. It allows the security operations centers (SOC) operational personnel to make decisions on their detection promptly and reasonably. It is based on the technologies of data mining, machine learning, big data processing and artificial intelligence (Figure 1).
The proposed architecture consists of the following components [2][3][4][5][6][7][8][9][10]: information collection subsystem -a set of sensors on network nodes that collect and process primary data on network activity; analyzer -the module of the first echelon of cyber attack detection -analyzes security events (incidents) and on the basis of signature analysis classifies harmful activity as cyber attack; signature database -a dictionary of signatures of classified cyberattacks used by the componentanalyzer; statistical database -statistics of telemetry of network traffic for a certain period for its further use in order to improve the system to adapt the parameters of the mechanism of detection of cyber attacks to existing changes; scheduler -plans further actions of the system after processing by the analyzer (in case it detects a cyberattack, the scheduler gives control to the response module to take measures to stop malicious activity; otherwise, the scheduler gives control to the data analysis module detection cyber attacks second tier, built on the basis of the developed model of cyberattack detection [8][9][10][11];
fasificationblock -clear values of the studied parameters are turned into fuzzy (the degree of their belonging to the term sets of linguistic variables specified by experts is determined). Fuzzy network activity is taken into account based on the application of the model proposed in [8][9][10][11]; fuzzy rule base: contains fuzzy production rules built by experts at the stage of preparing the system for operation; adaptation module: performs primary parametric adjustment of membership functions by means of genetic algorithms on the basis of a certain training sample and further training of the system if necessary on the basis of statistical data to clarify the values of cyber attack detection mechanism; fuzzy inference block -a module for making decisions about the state of the network based on determining the relationship between input data (telemetry of network traffic) and expert opinions by means of fuzzy logic; Figure 1. Architecture of a promising fuzzy intelligent system for detecting cyber attacks response module -generates requests and notifications to the console, takes protective measures to block detected cyberattacks, as well as fills the database of statistical decisions on their decisions for further use by the adaptation module; management console: module for configuring the cybersecurity officer of the system parameters.
The application of the proposed IDS architecture allows to increase the efficiency of detecting cyberattacks in near real time, based on the application of a multi-tiered approach to their detection. In addition, it becomes possible to adapt the system to the detection of unknown types of cyber attacks (zero day), as well as increase the efficiency of the cybersecurity officer on such indicators as efficiency and soundness of decision-making.
In [8][9][10][11] -models and methods for detecting known and polymorphic cyber attacks based on the theory of fuzzy sets and fuzzy inference. Formally, the task of fuzzy identification of a cyber attack is to find a solution to analytical expression that connects a set of parameters of the state of the system, on the basis of which its anomalous behavior is determined and an expert solution that meets them, taking into account the weighting coefficients for fuzzy rules (Figure 2): To evaluate the effectiveness of the proposed solutions, a system simulation model (FIDM -Fuzzy Intrusion Detection Model) was developed using the Fuzzy Logic Toolbox™ package,which provides MATLAB® functions and the Simulink® block [13,14,15] for designing and modeling systems based on fuzzy logic.
The functional diagram of the simulation model is shown in Figure 3, where x1..xn are input parameters and y is an output variable.
The basis of the proposed simulation model is a modular diagram for organizing sequential iterative interaction between its components: a data input module for analysis, a fuzzification module, a knowledge base (KB), a fuzzy inference and defuzzification module [13,14,15]. The structure diagram of the developed simulation model is shown in Figure 4.
For the operation of the test data input module [16], is a set of statistical data on cyberattacks KDD Cup 1999 Data (xlsx files) was used.
The purpose of the fuzzification module is to represent the quantitative and qualitative values of the studied parameters using term sets and linguistic variables. Incomplete and uncertain data on network activity were taken into account by applying the developed model of cyber attack detection.
Additional rules generation module was used to create new fuzzy production rules in the knowledge base by intersecting fuzzy sets of linguistic variables of previously existing rules and the most significant linguistic variables predefined by an expert for each class of cyberattacks.
The knowledge base is a set of fuzzy production rules built by an expert. The purpose of the fuzzy inference module is to generate a decision about the state of the information and communications network based on determining the relationship between input data and expert conclusions using fuzzy logic.
The defuzzification module was used to convert the obtained values of the fuzzy inference into crisp ones.
Step 1: Defining is a set of cyber attackstatistics: KDD Cup 1999 Data [16].
Step 2. Defining the classes of cyberattacks to be detected [16]: Denial of Service, Remote to Local, User to Root, Probe and normal states of the ICS.
Step 3. The input of the simulation model was fed with vectors of cyber attacks of the KDD Cup 1999 Data set in the number of: known -Denial of Service -4264, Remote to Local -1020, User to Root -52, Probe -3231; normal states of the information system -1000; polymorphic cyberattacks built on the basis of known ones -100. Thus, the total number of attribute vectors was 9667.
For the study, 38 parameters of network traffic telemetry were selected based on the classification proposed in the chosen data set on cyberattacks (Table 1). Step 4. Defining the type of membership functions to describe the ranges of values of the studied parameters and the power of term sets for input and output linguistic variables: triangular membership functions (2) due to the ability to undergo parametric adaptation (refinement) while maintaining an acceptable level of computational complexity [17][18][19][20][21][22], term set power -7 (number: VS is acronym for "very small", S is acronym for "small", BA is acronym for "below average", A is acronym for "average", AA is acronym for "above average", L is acronym for "large", VL is acronym for "very large").
where a, b, c is a some numeric parameters that take arbitrary real values and are ordered by relations:
Step 5. Defining input and output linguistic variables: 38 input linguistic variables that correspond to the number of studied parameters of network traffic and one output -an indicator of the state of the information and communications system. Each input value (𝑥 ) corresponds to the network traffic parameter according to the KDD Cup 1999 Data, and the membership functions configured by the expert are represented by term sets. Step 6. Preparing test data format of KDD Cup 1999 Data for the Fuzzy Logic Toolbox™ software.
Step 7. Creating fuzzy production rules for the KB based on the KDD Cup 1999 Data set using association rule search algorithms (Fig. 6) [23,24].
Step 8. Obtaining expert conclusions about the state of IP according to the classification of cyber attacks presented in the KDD Cup 1999 Data: Denial of Service, Remote to Local, User to Root, Probe and normal state: total number of rules: 335, of which Denial of Service -68; Remote to Local -55; User to Root -18; Probe -107; Normal -87.
Step 9. Parametric adaptation of constructed membership functions [25,26,27] in order to clarify the subjective point of view of the expert by means of the Optimization Tool package of MATLAB® software [13,14,15]: on the basis of the frequent data sets found at the previous stage, parametric optimization of membership functions was performed for the above terms of each studied variable (search for the optimum of the parameter vector of the system of equations of the analytical model of the triangular membership function).
Step 10. Determining the required number of the most important (informative) parameters (features) for each known class of cyberattacks, represented as fuzzy sets of linguistic variables that characterize them quite fully in order to be able to identify polymorphic modifications of known cyberattacks: Step 12. Application of the developed program code for the correct input of data from the cyberattack data set for further analysis by the Fuzzy Logic Toolbox™ library. Step 13. Conducting experimental studies on cyber attack detection by a developed simulation model, the functioning of which is based on the application of models and methods and comparative analysis of the results of modeling the process of detecting cyber attacks based on the proposed approach with existing methods for detecting cyber attacks: based on the theory of fuzzy sets and fuzzy logic, artificial immune systems and neural networks in terms of accuracy. where TD (True Detection) is the number of correctly detected cyber attacks; FN (False Negative) is a type II errors (classifying a cyber attack as a normal state).
A comparative analysis of the results of modeling the process of cyber attack detection based on the approach proposed in the study and existing solutions in terms of accuracy are presented in Table 2.
The results of the study were included in the methodology of rational choice of security incident management system for building operational security center [28].
The practical application of the developed simulation model of a fuzzy cyber attack detection system showed the expediency of using it to evaluate models and methods of cyber attack detection based on the theory of fuzzy sets and fuzzy inference. Thus, the comparison of the developed scientific and methodological apparatus with the already available ones shows that its use makes it possible to increase the effectiveness of information systems cyber protection in terms of the accuracy of detecting known cyber attacks by an average of 10%, as well as to ensure the detection of polymorphic cyber attacks in terms of accuracy of at least 98 %.