Method of Determining the Importance Factor of IT Security Projects Investment Attractiveness in Critical Infrastructures

Abstract

The consistent implementation of the policy of attracting direct foreign investments to the development of post-war Ukraine urgently requires the use of modern systems and IT for expert research of potential objects of these investments. The more indicators and characteristics are applied, the more objective the conclusion will be regarding the degree of investment attractiveness of a specific object of expertise. It is substantiated that the specified assessment of the investment attractiveness degree of the object of examination is obtained using the multiplicative function of aggregation, which takes into account the normalized Coefficients of Importance (CI) of both the relevant features of investment attractiveness and indicators of the degree of their expressiveness in a specific object. From the comparative analysis of these methods, it was determined that the mathematical method of setting priorities is more acceptable for research purposes. The paper presents a method for determining the CI of the investment attractiveness of ITsecurity projects in critical infrastructures, which, due to the synthesis of the method and procedures for calculating the total value of the value and comparing it with the established criterion of importance, makes it possible to determine the optimal iteration of the method and ensure both the nonlinearity of the obtained CI and acceptable accuracy of calculations. During its implementation, it was substantiated that the results of the second iteration are more acceptable, and the first ten (55.55%) in terms of the level of importance of features of the investment attractiveness of the examination objects provide a total contribution to the overall significance that exceeds the established criterion of 0.9.

Keywords

• 1 IT security
• project
• informatization
• critical infrastructure
• importance
• coefficients of importance
• investment attractiveness
• examination
• method of setting priorities

1. Introduction

The attraction of foreign direct investments for the development of post-war Ukraine requires a comprehensive and systematic information analysis of the investment objects. Today the development of IT projects and IT-security projects aimed at the creation, development, integration, and support of information and communication systems, networks, resources, and information and communication technologies, which are implemented within the framework of the National Informatization Program and provide for additional funding, is gaining in importance [1–3]. The greater the number of indicators and characteristics employed, the more objective the assessment of the Investment Attractiveness (IA) of a particular project or Object Of Expertise (OE) becomes, particularly in the realm of informatization. Therefore, the solution of a multi-criteria Decision Making (DM) problem is involved, for which appropriate methods of system analysis and DM theory should be applied [4–6], which, according to research [7], can be represented as follows: OEk , k = 1, K :

 q, L  CI OEopt. = mkax  i=1n,,j=L1k ( PI i , CBijk )  , ( 1 )  q   n−q i=q+1k ( PI i , CBijk )    where k ( PIi , CBijk ) is the aggregate function of IA of the kth studied OE (OEk) according to the ith characteristic feature of IA used in the process of evaluation (Table 1); DSіjk is an indicator of the Degree of Severity (DS) of the ith Characteristic Peculiarities of Investment Attractiveness (CPIP) in the kth studied OE, determined by a special scale: ( 2 ) ( 3 )

R%CДBBPI R%CBB PI R%CCB PI R%CHB PI R%CДBHPI T M (CB PI) = very high+ high +medium (normal)+ low + very low = = R%CДBBPI + R%CBB PI + R%CCB PI + R%CHB PI + R%CДBHPI , (PIP— PI Pi ) linguistic assessments) into a scale, the priority of which is clear:

It should also be noted that the numerator in ( 1 ) aggregates the PIP OE indicators, whose value should be increased, and the denominator, on the contrary, should be decreased. And if we assign normalized “weighting” factors to the CPIP and DS CPIP indicators (Fig. 1): The introduction of the CI and the transition from ( 1 ) to ( 5 ) is important and relevant as, on the one hand, the knowledge of the normalizing factors is used in forecasting and planning, project analysis, operational management, risk assessment in ergonomic systems, product quality, etc. [4, 8–10].

n PIi   i : 0   i  1,  i = 1,  iL=1 CBij  ij : 0   ij  1,  ij = 1,  i=1 then ( 1 ) turns into the following: OEk , k = 1, K :

 q, L  CI OEopt. = mkax  q i=1n,,j=L1  i  i jk  , ( 5 )

 n−q i=q+1, j=1  i  i jk  where ijk is the normalized Coefficient of the Importance (CI) of the DS of the ith CPIP in OEk. 2. Analysis of Modern Approaches

and Problem Statement The problems of CI (weight, significance, attractiveness) determination are the subject of many modern scientific studies [4, 8–12], the results of which are used: • In the decision-making theory for dividing criteria into groups and building preference relations. • To determine lexical and graphical

ordering. • In solving problems with homogeneous equivalent criteria by the method of generalized criterion and construction of decisive rules. • In pattern recognition, for building classification algorithms, the so-called “voting” algorithms/calculation of scores, etc.

The main purpose of CI is to compare different values, qualities, criteria, properties, components, etc. in a single comprehensive measure of these values, properties, criteria, etc. A strict definition of the weighting coefficients used in the CI theory is also given within the expected or cardinal theory of utility [11–13].

In the context of this study, it is necessary to establish the weighting factors for PIP OE (Table 1) and DS CIP OE indicators (see ( 2 )), which usually occur according to the scheme shown in Fig. 1. Based on the analysis of papers [4, 13], it can be noted that it is more convenient to find the desired weighting coefficients based on the systems of preferences of the specialists on the set of the CPIP OE. At the same time, PS is understood as a reasonable order of these indicators and features: from more acceptable, important, and significant to less important. It should be noted that PS is trivial on the DS PIP OE indicators and is defined in ( 3 ).

By implementing a multi-stage technology for the detection and elimination of marginal opinions and eliminating the “systematic survivor error”, we obtained a statistically significant PS of specialists on the CPIP OE set at a high level of significance  = 1%. Further optimization of this PS using the classical Savage decision criterion and the Kemeny median resulted in the following benchmark ranking:

PI P4 PI P15 mC PI P5

mC mC mC PI P7 mC PI P10 mC PI P13 mC PI P14 mC PI P6 mC PI P16 mC PI P1 mC PI P17 mC PI P3 mC PI P18 mC PI P8

PI P2

mC PI P11 mC mC PI P12 mC PI P9 , ( 6 ) where f is a mark of superiority of one PIP OE over another in the “reference” PS.

Thus, a “reference” Group PS (GPS) of experts on the set of characteristic PIP OEs is obtained, which is indicated in the ranking scale and only gives an idea of the comparative importance of the identified features. The quantitative assessment of the difference in importance is determined by the difference in the rankings they occupy in the GPS ( 6 ).

However, given the peculiarities of measurements in ranking scales [4, 13–15], it is impossible to answer the question of how many times one PIP OE is more significant than another.

Thus, from the spectrum of methods for determining weighting factors, the ones that are based on PS, and accordingly on PIP ranks or their DS indicators, should be selected, for which these factors should be set. Let us consider such methods in detail.

The ranking method [4, 13] proposes to first determine the value of each PIP under consideration:

CPIi = 1− rPIi −1 , ( 7 )

n where rPIi is the rank of the ith PIP OE in the “reference” PS, which is shown in ( 6 ); n is the number of ordered PIPs. In this case, n = 18.

Next, it is trivial to determine the total “value” of the PIPs that were studied:

CPI =  CPIi =  1− rPIi −1 , ( 8 ) n n  i=1 i=1  n  and their normalized coefficients:    PIi = nCPIi =  i=1 CPIi  (n +1) − rPIi = n  (n2 +1) −  rPIi  i=1      1− rPIi −1

n  1− rPIi −1  n  i=1  n 

= = 2 ((n +1) − rPIi ) , ( 9 )

n (n −1) + 2 n  PIi = 1, 0   PIi  1.

i=1 The normalized coefficients  PIi obtained in the above way are reliable in the sense that not only the agreed, but even the “reference” GPS is used, which results in the more significant PIP OE having a higher rank, and therefore a higher “weight”, and consequently a higher value of the normalized coefficient. On the other hand, the estimates CPIi and  PIi are “rough” because in ( 7 ) and hence ( 8 ) we assume their linear dependence on the rank of the corresponding PIПі in the GPS, which is reflected in ( 6 ). It should also be noted that since the measurements of the importance of PIP OE are made on an ordered scale, the mathematical operations on the ranks provided in ( 8 ) and ( 9 ) are inadmissible.

Therefore, methods of more subtle estimation of CPIi and  PIi .should be used.

The method of averaged ranks [9, 12]. If rij is the rank assigned by the jth specialist to the ith PIP OE in the Individual PS (IPS), which was aggregated to obtain the “reference” GPS and displayed in ( 6 ), then the average rank of the ith PIP is determined as follows:

1 m rPIi =  rij . ( 10 )

m j=1

The sum of the ranks of the ordered set of PIPs defined by the “reference” GPS shown in ( 6 ) is equal:

n rPI =  rij = i=1 n ( n +1)

.

2

Given that n=18, let’s determine that rPI = 171. Comparing ( 10 ) and ( 11 ), we can easily find the desired CI PIP: ( 11 ) m  rij  PIi = 1− rPIi = 1− j=1

n rPI m rij i=1 = 1− n 0  PIi  1,  PIi = 1.

i=1 Analyzing ( 12 ), it is easy to see that the considered method of averaged ranks, like the previous approach, is simple and contributes to obtaining reliable estimates when a more significant PIP receives a smaller average rank in absolute value, and therefore a larger CI.

The disadvantages of the method are the following: first, the estimates of the desired CI of the PIP OE are rough, since the IPS of the specialists aggregated in the “reference” GPS ( 6 ) are generally statistically significant, so one cannot be sure of the non-linearity of the  PIi CI obtained; second, the mathematical operations on the ranks of the PIP OE, provided for in ( 10 ), ( 12 ), are not allowed in the ordering scale where they are measured.

The method of prioritization [4, 13], also known as the “leader problem,” is effective for solving practical problems, which in the context of this study are as follows: • determining the more important PIP

from the identified spectrum. • organization of PIPs. • determination of the quantitative

indicator (CI PIP OE).

The mathematical formulation of the problem is as follows. Each PI i , i = 1, n is represented by the vertex of the graph (Fig. 2) corresponding to the results of their comparative pairwise analysis by importance.

If PI i has an advantage over PI  j ( PI i f PI  j ) by the level of importance, then there is an arc i → j on the graph. On the other hand, if PI  j f PI i , then there is an arc j → i on the graph. The case when PI i and PI  j are adequate in terms of importance: PI i  PI  j , corresponds to the presence of an arc i  j .

CPI1 ( 1 ) , CPI2 ( 1 ) ,K ,  C ( 1 ) =   .

CPIi ( 1 ) ,K , CPIn ( 1 )  (15)

In the second iteration, the “weight” of the value of PIПi is its iterated “weight” of the first order. The iterated “weight” of the value of PIP of second order is calculated taking into account the values of the other PIPs:

n Ci ( 2 ) =  cijC j ( 1 ) (16) j=1

The iterated “weight” of PIP values of the second order is represented by the following vector:

Subsequent iterations of the PIP OE “weight” are carried out in the same way: (17) (18) (19) In this case:

C ( k ) = C  C (k −1).

P (0) = (1, 1, K , 1).

Thus, according to the priority method under consideration, the process of calculating the quantitative indicators (“weights”) of PIP OE consists of the sequential application of the transformation specified by the matrix C to the initial vector P (0) . Define PPвIіднi. ( k ) by the normalized iterated “weight” of the kth order of PIПi:

CPIi (k )

n ;  PвіIдн.i (k ) = 1.  PвіIдн.i (k ) = n (20)  CPIi (k ) i=1 i=1

In general, the process of calculating the normalized iterated “weight” of the PIP OE can be represented as [13]:  відн. ( k ) =  (1k ) C  відн. ( k − 1) (21)

n n where  ( k ) =   cPIi j PвіIдн.i (k − 1) is the

j=1 i=1 sum of the vector components of C  P ( k – 1) ; k = 1, 2,

At each subsequent iteration, the values  (i) ( k ) are refined. If the matrix C is not decomposable, then according to the PerronFrobenius theorem this leads to the limit to the maximum eigenvalue  = lim (k ) of the matrix

k→ C with the corresponding eigenvector [15]:  = lim ( k ) k→ (22)

Thus, the process of calculating the normalized iterated “weight” PIP OE is convergent. The calculation according to (20) and (21) differs from the simple summation of points in that it allows the indirect advantages of one PIP OE over another to be taken into account.

Defining the research task. It should be noted that in previous studies, the authors obtained a “reference” GPS, where the importance of a particular CPIP OE is determined by the corresponding rank. On the other hand, the analysis shows that a more effective method of determining the CI of CPIP OEs that uses ranks is the prioritization method.

Thus, the purpose of this paper is to develop and study a method for determining the CI of investment attractiveness of IT projects. 3. Method for Determining the CI of Investment Attractiveness of IT Projects The proposed method is implemented in four stages, which are shown in Fig. 3.

Creating a graph that shows the prioritization Stage 1 of PIP OE by level of importance.

Determining the normalized iterated "value" of Stage 2 CPIP.

Сreating a square adjacency matrix for each Stage 3 iteration.

Calculation of the total value at each iteration

Stage 4 and comparison with the importance criterion.

Here is a closer look at each of the proposed stages of the method.

Stage 1. Building a Graph Showing the Priority of PIP OE by Level of Importance

First, let’s build a graph showing the priority of PIP OE by level of importance (Fig. 4). Stage 2: Determine the Normalized Iterated CPIP “Value”

Next, let’s consider the process of calculating the normalized iterated “value” of the CPIP OE. From the “reference” GPS shown in ( 6 ), we have the following results from the pairwise determination of the importance of these features.

PI1 p PI8 PI1 f PI9 PI1 p PI10 PI1 p PI11 PI1 p PI14 PI1 p PI17 PI2 p PI3 PI2 f PI6 PI2 f PI9 PI1 p PI5 PI2 f PI11 PI2 f PI14 PI2 p PI17 PI3 p PI4 PI3 f PI7 PI3 f PI10 PI3 f PI13

PI1 f PI12 PI1 p PI15 PI1 p PI18 PI2 p PI4 PI2 f PI7 PI2 f PI10 PI1 p PI6 PI2 f PI12 PI2 p PI15 PI2 p PI18 PI3 p PI5 PI3 f PI8 PI3 f PI11 PI3 f PI14

PI1 p PI13 PI1 p PI16 PI2 p PI5 PI2 f PI8 PI1 p PI7

PI2 f PI13

PI2PI16 PI3 f PI6 PI3 f PI9

PI3 f PI12 PI3 p PI15 PI3 f PI16 PI3 p PI17 PI3 f PI18 M M M M M M M M M M M M M M M M M M M PI15 f PI16 PI15 f PI17 PI15 f PI18

PI16 p PI17 PI16 p PI18 PI17 f PI18 Note that for the convenience of calculations, the sequence of PIP OEs in Table 2 is presented by their rank places determined by the “reference” GPS [9]. The calculation for the first iteration of the method is trivial and is presented in columns 20 and 21 of Table 2.

The calculation for the second iteration is as follows: CPI15 ( 2 ) = 135 + 2  (33 + 31+ 29 + 27 + 25 + 23 + M M M M M M M M M M M M M M M

By analogy, the results of the third iteration of the method are calculated and presented in columns 24 and 25 of the same table. It is inexpedient to make subsequent iterations, since with the accepted accuracy of calculations to the fourth decimal place, the coefficient of the less important PIП9 reaches the value  PI9 ( 3 ) = 0, 0000 starting from this iteration. This is generally unacceptable.

Fig. 5 gives a visual representation of the dynamics of differentiation of the values of the hazard ratios of the studied errors depending on the number of iterations of this method.

As can be seen in Fig. 5, in the first iteration of the prioritization method, the change in CI PIP OE from most significant to least significant is linear and therefore unacceptable. The inappropriateness of focusing on the results of the third and subsequent iterations of the method has already been demonstrated.

Therefore, for further quantitative analysis of the importance of the CPIP OEs under study, we choose the results obtained in the second iteration. On the one hand, the change of these coefficients is non-linear, which generally corresponds to the idea of the importance of the influence of neighboring PIPs on their total value. On the other hand, the quantitative differentiation of the  PIi CIs is as acceptable as possible for the accepted accuracy of their calculations to the fourth decimal place. Fig. 6, like Fig. 5, also illustrates the importance of the PIP OEs studied.

Stage 4. Calculation of the Total Value at Each Iteration and Comparison with the Importance Criterion

Let’s find out the total contribution of the partial importance of individual PIPs to their total value. To do this, let’s introduce the following important criterion based on [16–19]: kn  PIi  0, 9. (24) i=1

The implementation of criterion (24) led to the following results: k=17  PIi =  PI15 + PI5 + PI4 + PI17 + PI3 + i=1 make an absolute contribution to the total importance of the entire spectrum studied.

4. Conclusion

The paper analyzes the known methods of + PI18 + PI2 + PI11 + PI8 + PI10 + PI7 + determining the CI and establishes that the method of prioritization is more acceptable for + PI14 + PI13 + PI16 + PI6 + PI1 + PI12 = research purposes, which, depending on the = 0,1574 + 0,1400 + 0,1235 + 0,1081+ 0, 0937 + iteration, allows to obtain the desired CI with +0, 0804 + 0, 0681+ 0, 0568 + 0, 0465 + 0, 0372 + any non-linearity. +0, 0290 + 0, 0218 + 0, 0157 + 0, 0105 + 0, 0064 + A method for determining the CI of +0, 0033 + 0, 0013 = 0, 9997  0, 9 investment attractiveness of IT security k=16 projects in critical infrastructures has been  PIi =  PI15 + PI5 + PI4 + PI17 + PI3 + developed, which, by synthesizing the method i=1 and procedures for calculating the total value + PI18 + PI2 + PI11 + PI8 + PI10 + PI7 + and comparing it with the established + PI14 + PI13 + PI16 + PI6 + PI1 = importance criterion, allows to determine the = 0,1574 + 0,1400 + 0,1235 + 0,1081+ 0, 0937 + optimal iteration and to ensure both the +0, 0804 + 0, 0681+ 0, 0568 + 0, 0465 + 0, 0372 + nonlinearity of the obtained CI PIP OE and acceptable calculation accuracy [20–21]. +0, 0290 + 0, 0218 + 0, 0157 + 0, 0105 + 0, 0064 + The obtained top ten PIP OEs in terms of +0, 0033 = 0, 9984  0, 9 importance (55.55%), namely PIП15, PIП5, PIП4, k=15 PIП17, PIП3, PIП18, PIП2, PIП11, PIП8, PIП10, provide i=1  PIi = PI15 + PI5 + PI4 + PI17 + PI3 + an absolute contribution to the total importance of the entire studied spectrum that +0,1235 + 0,1081+ 0, 0937 + 0, 0804 + 0, 0681+ +0, 0568 + 0, 0465 = 0,8745  0,9

It turned out that the top ten PIP OEs in terms of importance (55.55%), namely PIП15, PIП5, PIП4, PIП17, PIП3, PIП18, PIП2, PIП11, PIП8, PIП10,

References

[1] V. Buriachok , V. Sokolov , P. Skladannyi , Security Rating Metrics for Distributed Wireless Systems , in: 8th Int. Conf. on “Mathematics Inf. Technolog. Educ.” Modern Machine Learning Technol. and Data Sci . 2386 ( 2019 ) 222 - 233 .

[2] F. Kipchuk , et al., Assessing Approaches [14] V. Tsiutsiura , S. Tsiutsiura , Metrology of IT Infrastructure Audit, in: IEEE 8th and Basics of Measurements: a Textbook , International Conference on Problems of Znannya-Press ( 2003 ). Infocommunications, Science and [15] A. Tikhomirov , et al., Network Society : Technology ( 2021 ). doi: Aggregate Topological Models, Inf. 10 .1109/picst54195. 2021 . 9772181 . Technol. Math. Model. ( 2014 ) 415 - 421 .

[3] I. Kuzminykh , et al., Investigation of the [16] P. Stukhliak , et al., Information Theory IoT Device Lifetime with Secure Data (Information and Measurement Systems , Transmission, Internet of Things, Smart Errors, Identification): Textbook, Ailant Spaces , and Next Generation Networks ( 2011 ). and Systems , vol. 11660 ( 2019 ) 16 - 27 . [17] M. Iavich , et al., The Novel System of doi: 10 .1007/978-3- 030 -30859- 9 _ 2 . Attacks Detection in 5G, Adv. Inf.

[4] O. Reva , et al., Human Factor: Networking Appl . ( 2021 ) 580 - 591 . Methodology of Proactive Qualimetry of [18] O. Reva , V. Kamyshyn , Method for Air Traffic Controllers Error Threats: Determining the Integrative Indicator of Monograph, UkrINTEI ( 2020 ). doi: Expert Competence, Sci. Technol. Innov. 10 .35668/ 978 -966-479-120- 2 . 3 ( 2018 ) 27 - 38 .

[5] I. Tvoroshenko , Decision-Making [19] S. Gnatyuk , Critical Aviation Information Technologies in Information Systems: a Systems Cybersecurity , Meeting Security Textbook, Kharkiv ( 2021 ). Challenges Through Data Analytics and

[6] S. Us , L. Koryashkina, Models and Decision Support 47 ( 3 ) ( 2016 ) 308 - 316 . Methods of Decision-Making: a doi: 10 .3233/978-1- 61499 -716-0- 308 . Textbook, National Mining University, [20] V. Grechaninov , et al., Decentralized Dnipropetrovsk ( 2014 ). Access Demarcation System

[7] O. Reva , et al., Theoretical Foundations Construction in Situational Center of the Methodology of Integrative Network , in: Workshop on Cybersecurity Assessment of the Degree of Investment Providing in Information and Attractiveness of Intellectual Property, Telecommunication Systems II, vol . Sci. Technol . Innov. 1 ( 17 ) ( 2021 ) 3 - 16 . 3188, no. 2 ( 2022 ) 197 - 206 . doi: 10 .35668/ 2520 -6524-2021-1-01. [21] V. Grechaninov , et al., Formation of

[8] Y. Gunko , A. Spirin , O. Kholodnyuk , Dependability and Cyber Protection Reliability of Systems and Justification of Model in Information Systems of Engineering Solutions, Vinnytsia: VDAU Situational Center , in: Workshop on ( 2006 ). Emerging Technology Trends on the

[9] S. Budenko , Determination of the Smart Industry and the Internet of Importance of the Criteria of the Things , vol. 3149 ( 2022 ) 107 - 117 . Technical Level of Machines: Methodical [22] Y. Danik , R. Hryschuk , S. Gnatyuk , Instructions for Students of Specialty Synergistic Effects of Information and 133 Branch Engineering , TSAU ( 2016 ). Cybernetic Interaction in Civil Aviation,

[10] O. Zorina , T. Neskuba , O. Mkrtichian , Aviation 20 ( 3 ) ( 2016 ) 137 - 144 . doi: Forecasting of Transport Services: 10 .3846/16487788. 2016 . 1237787 . Lecture Notes, UkrDUZT ( 2021 ). [23] O. Reva , et al., Testing of the a-method of

[11] H. Hnatienko , V. Snitiuk , Expert comparing preference systems (on the Decision-Making Technologies, McLouth example of comparing air traffic LLC ( 2008 ). controllers' preference systems on the

[12] T. Boyko , Review of Methods for dangers of characteristic errors), Determining the Weighting Coefficients Intelligent Decision-Making Systems and of Indicators of Product Properties, Problems of Computational Intelligence Methods and Devices of Quality Control ( 2021 ) 63 - 64 . 1( 24 ) ( 2010 ) 84 - 89 . [24] J. Al-Azzeh , et al., Analysis of Self-Similar

[13] V. Kamyshyn , O. Reva , Methods of Traffic Models in Computer Networks, System Analysis in the Qualimetry of the Int . Rev. Modelling Simul . 10 ( 5 ) ( 2017 ) Educational Process: Monograph, 328 - 336 . doi: 10 .15866/iremos.v10i5. Information Systems ( 2012 ). 12009 .