Electronic Professional Scientific Journal «Cybersecurity: Education, Science, Technique»
Електронне наукове видання "Кібербезпека: освіта, наука, техніка" є рецензованим технічним часописом, присвяченим проблемам використання інформаційної та кібернетичної безпека та інформаційних технологій. В журналі «Кібербезпека: освіта, наука, техніка» публікуються наукові статті за фахом наукових спеціальностей: 05.13.21 - системи захисту інформації; 21.05.01 - інформаційна безпека держави; 05.13.05 - інформаційні технології Галузь науки: технічні науки. Періодичність: 4 рази на рік.
Cybersecurity: Education, Science, Technique
EFFICIENCY OF SOFTWARE FOR NATIONAL CYBERSECURITY
The article presents a method for assessing the effectiveness of cybersecurity programs (CSP) considering cyberattacks and associated risks, which is a continuation of the authors' previous research. The proposed approach is based on a modification of the target dynamic evaluation method for programs over a specified time interval, enabling the consideration of a complex structure of interrelations between objectives, the impact of cyberattacks, risks, and delays in achieving results. The method involves constructing a network hierarchy of objectives in three stages: first, the main objective is decomposed from top to bottom by identifying sub-objectives that directly influence its achievement, with their types defined (quantitative, qualitative, deterministic, stochastic, qualifying, or threshold); second, a bottom-up analysis is performed to establish feedback loops; third, models of cyberattacks and risks are integrated into the hierarchy. Cyberattacks are modeled as special programs that negatively affect objectives, while risks are accounted for by introducing indicators in the form of additional objectives. The evaluation of CSP effectiveness is based on determining the degree of impact of program implementation (both simple and complex) on the achievement of the main objective. The paper introduces the concept of an instantaneous relative efficiency indicator, which allows analyzing the dynamics of efficiency at different implementation stages. An iterative algorithm for simulating the hierarchy is used to calculate the degree of objective achievement, taking into account nonlinearity, feedback, and time-dependent parameters. A key feature of the method is the ability to promptly recalculate efficiency when program structures change. The method is applied to assess the effectiveness of CSP implementation directions, sets of cyberattacks and risks, as well as countermeasures against them. The developed approach can be used not only in the field of cybersecurity but also for analyzing complex target programs in technical, economic, and other domains.
Copyright (c) 2025 Володимир Хорошко, Олександр Лаптєв, Микола Браіловський, Тетяна Лаптєва, Сергій Лаптєв https://creativecommons.org/licenses/by-nc-sa/4.0
RESEARCH ON METHODS OF ANALYSIS AND MODELING OF ELECTRONIC WARFARE SOURCES WITH CONSIDERATION OF SPATIAL-FREQUENCY ORIENTATION
The article examines modern approaches to the analysis and modeling of electronic warfare (EW) sources with consideration of spatial-frequency orientation. It is shown that the development of EW systems significantly changes the nature of contemporary armed conflicts, creating conditions under which classical methods of detection and counteraction against jamming signals lose effectiveness. In this context, the use of methods that allow a comprehensive assessment of both frequency and spatial characteristics of electromagnetic emissions becomes particularly relevant. The main directions in the development of spectral, statistical, and spatial analysis methods are analyzed, including high-resolution algorithms (MUSIC, ESPRIT), time-frequency transformation methods, as well as models that account for multipath propagation and dynamic environmental changes. Special attention is given to approaches for modeling EW sources that allow the creation of mathematical and simulation models considering wideband signals, adaptability, and complex signal structures. The results of the study indicate that integrating spatial-frequency analysis with modern signal processing methods and intelligent systems enhances the efficiency of detection, identification, and neutralization of EW sources. The obtained conclusions can be used to improve the algorithms of weapon systems operation and to develop new concepts for countermeasures in the field of electronic warfare.
Copyright (c) 2025 Роман Бибик, Іван Опірський https://creativecommons.org/licenses/by-nc-sa/4.0
AUTHENTICATION METHODS USING BEHAVIORAL ANALYTICS AND MACHINE LEARNING FOR INTERNET OF THINGS DEVICES
The growing complexity of cyber threats has highlighted the limitations of traditional authentication methods, including passwords, tokens, and standard two-factor authentication (2FA). In the Internet of Things (IoT) environment, these methods are particularly vulnerable due to limited computational resources, the dynamic nature of connections, and the need for seamless user–device interaction. In response to these challenges, behavioral analytics and machine learning (ML) are gaining increasing attention as they enable the development of adaptive, continuous, and user-transparent authentication systems. This study focuses on behavioral authentication methods, including keystroke dynamics, mouse movement patterns, geolocation data, session activity, and network traffic analysis. A modular architecture is proposed that integrates both supervised and unsupervised ML algorithms, such as Support Vector Machines (SVM), Random Forest, Artificial Neural Networks (ANN), and autoencoders. Based on a combination of public and experimental datasets, extensive preprocessing and feature engineering were applied to identify the most informative behavioral characteristics of users and devices. Experimental results showed that the Random Forest model achieved the highest accuracy (96%) and F1-score (0.94), while the deployed prototype system provided fast response times (0.6 s) and a low false positive rate (0.1%) in a real-time web environment. These findings confirm the practical applicability of behavioral authentication methods for IoT, where classical approaches are often ineffective. At the same time, several key implementation challenges were identified: the need for large volumes of training data, ensuring the privacy of behavioral patterns, integration into heterogeneous IoT ecosystems, and maintaining a balance between performance and accuracy. Promising directions for further research include optimizing algorithms for resource-constrained devices and applying federated learning to minimize the risks of data leakage. Thus, behavioral analytics combined with ML forms a new paradigm of authentication, capable of providing a high level of information security in the context of the rapid expansion of IoT.
Copyright (c) 2025 Євгеній Сокирка, Іван Кукулевський, Андрій Толбатов https://creativecommons.org/licenses/by-nc-sa/4.0
INFORMATION THREATS AND METHODS OF ENSURING SECURITY IN MODERN ONLINE GAMES
The article examines the issues of information security in modern online games, which in the context of digitalization have become not only a tool for entertainment, but also an important part of social interaction and communications. The emphasis is on a comprehensive analysis of the main cyber threats that users and developers of gaming services face. In particular, widespread attacks on accounts, phishing schemes, the use of bots and malicious software, as well as the implementation of massive DDoS attacks aimed at disrupting the availability of game servers, were studied in detail. Particular attention is paid to social engineering methods of influence that combine technical and psychological aspects of influencing players. An important component of the study was the construction of a model of information security threats that systematizes the types of attacks, the conditions for their occurrence, the level of damage, objects of violation (confidentiality, integrity, availability) and typical network ports used to implement threats. The proposed classification allows us to identify the most dangerous areas of influence on gaming systems and forms the basis for further development of protective mechanisms. It is shown that a significant part of attacks becomes possible due to vulnerabilities of the Windows operating system, which is the most common among gamers. Among the critical problems, driver exploits, vulnerabilities of network services (SMB, RDP, RPC), file system shortcomings, threats from untimely system updates and the use of zero-day exploits are highlighted. The work separately emphasizes the importance of studying Windows OS vulnerabilities in the context of ensuring the security of network games. Visualization of key attack vectors in the form of infographics clearly demonstrates the multi-level nature of risks and indicates the need to develop comprehensive protection methods. Additionally, the results of the analysis of the latest scientific publications and industry reports are presented, which confirm the growth in the number of attacks on players and developers and emphasize the inadequacy of traditional security tools. The practical contribution of the study was the concept of creating a tool in the Python language for detecting network attacks in real time. The use of libraries for traffic analysis (Scapy, Socket, PyShark) and algorithms for detecting anomalies in the behavior of network packets is proposed. This opens up prospects for creating effective protective solutions adapted to the specifics of online games, and also lays the foundation for further integration of intelligent systems based on machine learning. The conclusions emphasize that information security in online games is a multi-component problem that covers both technical and social aspects. The need for a comprehensive approach is identified, including the modernization of security protocols, regular updates of operating systems, the implementation of anti-cheat technologies, intrusion detection systems, and the formation of a culture of safe behavior among players. Prospects for further research are seen in expanding the functionality of the developed software tool, the application of artificial intelligence methods for predicting attacks, and the standardization of approaches to assessing the security of gaming ecosystems. Thus, the research results have both scientific and practical significance: they systematize existing threats, identify key weaknesses in the security of modern gaming environments, and offer applied solutions that will help increase the level of user security and trust in digital entertainment platforms.
Copyright (c) 2025 Орест Полотай, Тарас Брич, Артур Ткаченко, Максим Дітковський, Максим Гуменюк https://creativecommons.org/licenses/by-nc-sa/4.0
METHOD OF STRATEGIC PLANNING OF CYBERSECURITY MEASURES BASED ON THE SWOT CONCEPT
The paper proposes a method for strategic planning of cybersecurity measures for critical infrastructure objects, developed on the basis of a formalized SWOT model that integrates qualitative analysis of strengths, weaknesses, opportunities, and threats with quantitative assessment of risks, costs, and the effectiveness of protective actions. Unlike the classical descriptive SWOT analysis, which lacks analytical consistency, the proposed approach involves constructing a mathematical model of strategic planning in which each factor is represented by a weighted set, and the relationships between internal and external factors are defined through a strategic influence matrix. An integrated risk coefficient is introduced, taking into account the probability of threat realization, the level of its impact on critical functions, and the residual vulnerability of the system. This enables a transition from qualitative expert assessment to an optimization problem of maximizing cybersecurity effectiveness under resource constraints. The mathematical model implements multicriteria optimization, where the objective function describes the difference between the expected efficiency of measures and the weighted cost of their implementation while maintaining the permissible level of residual risk. To select a rational set of actions, methods of fuzzy normalization of evaluations and Pareto optimization are applied, ensuring adaptive planning in a dynamic threat environment. Based on the model, an architecture of a cybersecurity situational center is developed, implementing functions of monitoring, protection level assessment, risk forecasting, and decision support at the strategic level. Modeling results demonstrated that the use of the formalized SWOT approach increases coherence between tactical and strategic decisions, reduces residual risk by 25–30%, and enhances the resilience of critical infrastructure operations. The proposed method can be integrated into decision-support systems of cybersecurity situational centers and serve as an analytical core of national cybersecurity platforms to strengthen the resilience and continuity of critical infrastructure.
Copyright (c) 2025 Admin Skladannyi https://creativecommons.org/licenses/by-nc-sa/4.0
DEVELOPMENT OF A TEST ENVIRONMENT FOR EVALUATING THE EFFECTIVENESS OF IMPLEMENTED APPLICATION-LEVEL SECURITY MEASURES
The article addresses the problem of ensuring cybersecurity of corporate information and communication systems at the application level, which remains the main vector of modern cyberattacks. The limitations of traditional tools such as firewalls and antivirus software in countering vulnerabilities of web applications, APIs, and microservice architectures are emphasized. To overcome these challenges, the authors propose the development of a test environment enabling comprehensive assessment of implemented security measures, including access control, encryption, user activity monitoring, vulnerability detection and prevention, and real-time incident response. The proposed virtualized environment, built on VMware Workstation Pro and Oracle VirtualBox, is divided into three logical zones (DMZ, internal network, and instrumental zone) and integrates tools such as Burp Suite, OWASP ZAP, sqlmap, Splunk, Wazuh, and Metasploit. It allows the simulation of typical attack scenarios (SQL injection, XSS, CSRF, brute force, network scanning) to evaluate detection accuracy, false-positive rates, performance, and integration of different security components. The environment is aligned with international standards ISO/IEC 27001 and NIST SP 800-53, while its flexibility, scalability, and reproducibility make it suitable for both research and educational purposes. Results confirm the relevance of integrating the DevSecOps approach with SIEM, XDR, and SOAR technologies to strengthen application-level protection. The proposed solution provides a reliable foundation for evaluating and improving cybersecurity measures in real corporate environments.
CHALLENGES AND RISKS OF GLOBALIZATION IN THE FOCUS OF CYBERSECURITY
The article is devoted to the problems and risks of globalization, which caused the expansion of computer networks. This expansion resembles the process of Westernization in the era of late modernity, when, according to A. Toynbee, the “ubiquitous” Western society held the fate of all humanity in its hands, and is gradually revealing its shortcomings, in particular, in the field of information security. Data theft, insecurity of corporate networks, unauthorized access to information, attempts to exploit vulnerabilities and compromise systems have become one of the most common threats to the cybersecurity of information resources and individual corporations and companies, and states as a whole. In proportion to the development of capabilities and the emergence of new technological solutions that improve the use of networks, the “ingenuity” of cybercriminals is also developing: phishing, sniffing (the process of intercepting and analyzing network traffic using special devices and programs), infection with malicious software, etc. The spectrum and variability of cyber incidents is expanding, the targets of attacks are resources and databases of state institutions, infrastructure facilities, corporate networks. The reverse side of globalization is seen as a system of challenges and risks, which today must be foreseen not only by cybersecurity specialists, but also by digitalization specialists in all state and commercial structures and companies. Computer attackers use increasingly sophisticated methods to penetrate systems and databases, develop tools for infection and distribution of malicious software. There is a need to systematize knowledge and form separate branches to counteract malicious interference in the network and secure databases from cyberattacks.
Copyright (c) 2025 Георгій Суський https://creativecommons.org/licenses/by-nc-sa/4.0
MODELING OF ENVIRONMENTAL DATA PROCESSING FOR MOBILE MONITORING SYSTEMS BASED ON UAVS AND THE IDW METHOD
In the context of increasing technogenic risks and the need for rapid response to radiation-related emergencies, mobile environmental monitoring systems are becoming a critical component of national safety and public health protection. This article presents a comprehensive approach to modeling the processing of spatially distributed environmental data collected by unmanned aerial vehicles (UAVs) equipped with IoT-based radiation sensors. The proposed system architecture is based on a three-tier client-server model that separates data acquisition, processing, and visualization tasks. The UAV platform integrates lightweight, energy-efficient IoT sensors capable of real-time data transmission, including geolocation and radiation dose measurements. The core contribution of this research lies in the development of a data processing algorithm tailored for dynamic, irregularly spaced measurements. The algorithm includes noise filtering, temporal and spatial aggregation, and spatial interpolation using the Inverse Distance Weighting (IDW) method. The IDW technique was selected for its simplicity, transparency, and high sensitivity to local variations, making it suitable for generating detailed heatmaps of radioactive contamination. The modeling process demonstrates the algorithm’s ability to transform raw sensor data into continuous contamination surfaces, enabling intuitive interpretation and decision-making. Additionally, the article outlines the integration of the algorithm into a mobile application interface, which provides users with interactive access to processed data layers. The application retrieves pre-rendered heatmap tiles from the server based on the user’s viewport and zoom level, ensuring fast and responsive visualization. The system’s modular design allows for scalability and adaptation to various environmental monitoring scenarios. The research highlights the importance of combining UAV mobility, IoT sensor intelligence, and spatial modeling to overcome limitations of traditional monitoring systems. It also identifies future directions for enhancing interpolation accuracy through machine learning methods and expanding the system’s applicability to other types of environmental hazards.
Copyright (c) 2025 Тетяна Носенко, Ірина Машкіна https://creativecommons.org/licenses/by-nc-sa/4.0
INTELLIGENT CONTROL AND SECURITY SYSTEMS IN CYBER-PHYSICAL AND CLOUD ENVIRONMENTS OF SMART GRID
The paper examines methodological, algorithmic, and architectural approaches to designing intelligent control and defense systems aimed at ensuring the operational resilience of Smart Grids under the growing intensity of cyber threats. The necessity of transitioning from traditional IT-oriented security tools to hybrid adaptive solutions is substantiated. These solutions combine mechanisms of cyber-physical survivability, automatic recovery, and cognitive response to high-risk attacks such as Denial-of-Service, spoofing, and data injection. A conceptual model of Smart Grid resilience architecture is proposed, built on the synthesis of robust estimation methods, fault-tolerant control, distributed filtering (Distributed Kalman Filtering), and dynamic trust management models. A systematic classification of modern attack vectors targeting digital substations, SCADA, RTU, and HMI components is developed, with formalization of requirements for their protection in the context of both information and physical security. The study explores cloud-edge orchestration of Smart Grid telemetry streams, deploying analytics close to data sources (edge) and scalable aggregation in the cloud for model training and real-time event correlation. The proposed mechanisms account for latency, bandwidth, and workload isolation constraints within cloud environments. The paper highlights challenges in implementing continuous monitoring, anomaly detection, and real-time decision-making, and identifies future directions involving self-learning models for incident detection and reactive control based on artificial intelligence algorithms, considering scalability, reliability, and resilience to hidden threats. The effectiveness of the proposed model is confirmed through experimental simulation of false data injection, DoS, and spoofing attacks in digital substation environments of Smart Grids.
Copyright (c) 2025 Юлія Костюк, Павло Складанний, Світлана Рзаєва, Юлія Самойленко, Наталія Коршун https://creativecommons.org/licenses/by-nc-sa/4.0
PRACTICAL ASPECTS OF USING CRYPTOGRAPHIC METHODS TO PROTECT DATABASES FROM UNAUTHORIZED ACCESS
This paper analyzes the current state of static application security testing (SAST), a key component of DevSecOps practices. It provides an overview of the fundamental methodologies underlying SAST tools: from rule-based and pattern-based syntactic analysis that works with abstract syntax trees (ASTs) to more complex semantic approaches such as data flow analysis (DFA) on control flow graphs (CFGs), abstract interpretation, and symbolic execution. The central element of the study is an empirical comparison of three leading open source tools: SonarQube, which evolved from a code quality control platform; Semgrep, which focuses on speed and ease of integration into CI/CD; and GitHub CodeQL, which takes an innovative approach to representing code as a relational database for deep semantic analysis. To objectively assess their performance, a standardized set of OWASP Benchmark tests was used, which allowed us to measure key metrics: Precision, Recall, F1-Score, and False Positive Rate (FPR). The results of the quantitative analysis revealed significant differences: CodeQL demonstrated the highest balanced efficiency (F1-Score = 87.8%) due to its high completeness in detecting complex vulnerabilities associated with data flows, albeit at the expense of long scanning times; Semgrep provided the optimal ratio of speed and accuracy (F1-Score = 70.3%), making it suitable for rapid iterations in CI/CD pipelines; instead, SonarQube showed the lowest efficiency (F1-Score = 49.8%), missing more than 60% of real vulnerabilities, which confirms the limitations of non-specialized solutions in security tasks. The study proves that choosing a SAST tool is not only a technical but also a strategic decision that requires careful analysis of the trade-offs between depth of analysis, level of "noise", and speed of integration to form an effective and balanced web application security program.
Copyright (c) 2025 Денис Спис, Анна Ільєнко https://creativecommons.org/licenses/by-nc-sa/4.0
PRACTICAL SCHEME OF A HYBRID GENERATOR OF PSEUDORANDOMS BASED ON AUDIOENTROPY AND NONLINEAR BOOLEAN FUNCTIONS
The article solves the urgent problem of generating crypto-resistant pseudorandom sequences (PRS) to ensure the cybersecurity of modern digital systems. PRS generators play a key role in the formation of encryption keys, initialization vectors, one-time authentication tokens, and other critical parameters of cryptographic protocols. Insufficient crypto-resistance of such generators can lead to the compromise of reliable protocols, which emphasizes the need to develop new methods that overcome the limitations of traditional deterministic approaches. Among these limitations are the predictability of sequences in the event of disclosure of the internal state, limited entropy of initial values, vulnerability to statistical attacks, and the absence of true randomness, which reduces efficiency in cryptographic applications. The article proposes and implements a practical scheme for constructing a hybrid pseudorandom sequence generator that combines audio entropy and nonlinear Boolean functions in algebraic normal form (ANF). The architecture is based on the dynamic synthesis of output sequences of modified Jiffy generators using ANF functions with high nonlinearity, which are generated randomly. Audio entropy obtained from natural microphone noise is used to initialize the initial states of the generators, which increases the unpredictability of the sequences. The architecture is based on a modified Jiffy generator with flexible shift register parameters (lengths of 47, 53 and 59 bits), fixed feedbacks based on characteristic polynomials with prime numbers and static configurations of the output function. Special emphasis is placed on the use of algebraic normal form (ANF) of Boolean functions, which allows for effective analysis and optimization of the properties of nonlinearity, correlation stability and cryptanalysis complexity. The proposed hybrid architecture combines physical sources of entropy with efficient pseudorandom generation algorithms, achieving a balance between unpredictability and performance. This is relevant for embedded devices and Internet of Things (IoT) systems, where computing resources are limited, classical sources of entropy are absent, and there are requirements for energy efficiency and real-time. Comprehensive testing using NIST SP 800-22 confirmed the high statistical quality of the generated sequences: for 7 configurations (nonlinearity 24–224) it showed 100% success.
Copyright (c) 2025 Михайло Кіх, Олена Нємкова https://creativecommons.org/licenses/by-nc-sa/4.0
RESEARCH OF METHODS, MODELS AND MODERN IT SOLUTIONS TO SUPPORT TECHNOLOGICAL PROCESSES IN CRITICAL INFRASTRUCTURE OF THE STATE
The paper analyzes critical infrastructure in Europe, Asia, the USA and Ukraine (concept, structure, threats and challenges). It is determined that in the context of cyber threats, global digitalization and the need for rapid response to emergencies, there is a need to use modern methods and models of technological process support that provide flexibility, scalability and a high level of reliability. It is determined that modern technological process support is based on a combination of cloud technologies, IIoT, digital twins, big data analytics and cyber protection, critical infrastructure enterprise management, integrated into a single infrastructure of information and communication technologies based on modern network protocols. For critical infrastructure enterprises, the main criterion for selecting IT solutions is to ensure the continuity and stability of technological processes while simultaneously meeting the requirements of reliability, security (confidentiality, integrity, availability (CIA)), scalability and cost-effectiveness. The main methods and models of support (management, monitoring, efficiency assessment) of technological processes, determined as a result of the analysis of modern scientific publications and research projects in the field of support of technological processes in critical infrastructure, are presented. It is established that despite the large number of scientific studies in this area, there are a number of unresolved problems that need to be solved.
Copyright (c) 2025 Олексій Смірнов, Тетяна Смірнова https://creativecommons.org/licenses/by-nc-sa/4.0
METHODS OF IMPLEMENTING DISINFORMATION DETECTION IN SOCIAL NETWORKS BASED ON ARTIFICIAL INTELLIGENCE
The article considers modern approaches to automated detection of disinformation in social networks using artificial intelligence technologies. The evolution of methods is analyzed - from linguistic analysis of texts and classical machine learning algorithms to deep neural networks and transformative models. It is shown that traditional statistical methods do not provide the necessary accuracy when processing large amounts of data, while models based on CNN, RNN and BERT demonstrate high efficiency due to the ability to take into account context and semantic connections. Special attention is paid to multimodal analysis, which combines text, image and video processing to detect complex types of fakes, in particular deepfake. The use of the Leiden method is proposed as an innovative approach to clustering social graphs, which allows detecting coordinated communities of users spreading disinformation. An experimental study was conducted on data from the Twitter social network, which confirmed the high performance of the Leiden algorithm compared to the Louvain method. The obtained modularity (0.82) and cluster density (0.74) indicators demonstrated a clear structuring of disinformation communities and the ability to detect up to 78% of bot accounts. The developed model combines social graph analysis with natural language processing (NLP) methods to simultaneously identify sources of disinformation and the content of distributed messages. It is concluded that the integration of graph clustering methods and machine learning is a promising direction in creating automatic monitoring systems for social networks. Further research should focus on the development of explainable models (Explainable AI), multilingual adaptation, and the implementation of anti-fake technologies directly into the infrastructure of social platforms.
Copyright (c) 2025 Марія Назаркевич, Вікторія Висоцька, Ростислав Юринець, Назар Наконечний https://creativecommons.org/licenses/by-nc-sa/4.0
OPTIMIZATION OF HYBRID TCN, LSTM, AND LIGHTGBM MODELS FOR ENERGY CONSUMPTION FORECASTING IN SMART HOMES
Accurate short-term load forecasting is a key task for effective energy resource management in smart home systems. Hybrid models that combine deep learning (DL) architectures and decision tree ensembles are a leading direction in modern research. An analysis of recent publications confirms that comparing Long Short-Term Memory (LSTM) and Temporal Convolutional Network (TCN) networks is a popular topic, and hybridization with LightGBM and the use of error correction strategies ("residual forecasting") are proven practices for improving accuracy. However, a literature review reveals several unresolved parts of the general problem: 1) the lack of a systematic analysis of the trade-off between forecast accuracy and computational cost (training time, resource requirements), which is critical for implementation on Internet of Things (IoT) devices; 2) insufficient research on the impact of feature engineering, particularly feature selection, on the computational efficiency of hybrid models; 3) a tendency to focus on accuracy metrics without providing practical methodologies for selecting the optimal model depending on the specific task. This work aims to fill these gaps. A multi-stage experimental analysis was implemented. Two hybridization strategies were tested for the selected models: "peak correction" and "residual forecasting." A methodology for optimizing training time by selecting the most important features for the corrector model was developed. To ensure the statistical significance of the results, time-series cross-validation was applied. The study confirmed that hybrid models significantly outperform base models, and the "residual forecasting" strategy is the most effective. Two high-performance specialized configurations were identified. The LSTM + LightGBM hybrid demonstrated the highest overall accuracy (MAPE 13.36%). At the same time, the TCN + LightGBM hybrid proved to be more effective in forecasting critical peak loads (Peak Magnitude MAPE 16.71%) and was 21% faster to train. A key result is the proposed methodology for optimizing the TCN + LightGBM model through feature selection, which allowed for a 5.4-fold speed-up in training while maintaining high peak forecasting accuracy (Peak MAPE 16.77%). The work fills the identified gaps in the literature by providing not only quantitative results but also a practical methodology for the informed selection of a forecasting architecture depending on the priority tasks of a smart home system: maximum overall accuracy, priority management of peak loads, or balanced performance for resource-constrained devices. The proposed optimized hybrid approach is promising for practical implementation in adaptive energy management systems due to its proven balance of high accuracy and low computational costs.
Copyright (c) 2025 Дмитро Ніщеменко https://creativecommons.org/licenses/by-nc-sa/4.0
IMPLEMENTATION OF A HYBRID APPROACH BASED ON INTELLIGENT DATA ANALYSIS METHODS IN INTRUSION DETECTION SYSTEMS
The growth of cyber influence and its diversity in cyberspace require a proactive approach to the development of intelligent models and methods. These tools are necessary for effective data analysis and their application in the field of cyber countermeasures. It is critically important to research innovative solutions capable of navigating the complexities of large data sets. The goal of the research is to ensure not only the accuracy of the analysis, but also the timely receipt of valuable information. Such research efforts are indispensable for meeting the growing demand for reliable data processing capabilities in various sectors. The development of information technology has led to a significant increase in the number of attacks on information system components. This has made intrusion detection an extremely relevant and critical task. In this context, data mining methods offer broad opportunities for application in various scientific and technical fields, including information security. This article is devoted to the study of the application of data mining methods in intrusion detection systems (IDS). The paper classifies intrusion detection systems according to various criteria and analyzes the mathematical apparatus of the selected methods. An overview of popular data mining methods that are widely used to detect and counter cyber threats is provided. Three methods are considered in detail: support vectors, clustering, and principal components as standalone methods, and a hybrid intrusion detection method is created based on them. The effectiveness of the methods considered was evaluated using the true positive rate (TPR) and false positive rate (FPR) indicators. The hybrid method uses the principle of multi-layered protection. It combines the high accuracy of SVM for known threats with the high sensitivity of clustering/PCA for unknown threats, providing an optimal balance between true and false positives in a real environment.
Copyright (c) 2025 Сергій Толюпа, Андрій Кулько https://creativecommons.org/licenses/by-nc-sa/4.0
SYSTEMATIC ANALYSIS OF MAZE GENERATION ALGORITHMS IN INTERACTIVE GAME ENVIRONMENTS
Labyrinths in video games serve not only as navigation tools but also as complex design elements that combine technical, aesthetic, and gameplay functions. The use of procedural generation, interactive elements, and adaptive systems enables innovative approaches to construct virtual spaces. The purpose of this study is to develop a systematic classification of algorithms for the procedural generation of labyrinths for use in video game development and to determine their functional characteristics, advantages, and limitations, considering technical and game design requirements. The relevance of the research lies in the growing importance of procedural content in modern game development, which enhances replayability, adaptability, and reduces the cost of manual level design. This study presents a review and comparative analysis of modern maze generation algorithms, including classical approaches (DFS, Prim’s, Kruskal’s, Eller’s, Wilson’s, Aldous-Broder), cellular automata (Rule 4/5, Conway’s Game of Life, Maze CA, Mazectric, Hybrid CA), noise functions (Perlin, Simplex, Worley), fractal systems (L-systems, Hilbert curves), and machine learning-based algorithms (neuroevolution, Wave Function Collapse, Markov models). A classification of algorithms by the type of underlying structure (graph, grid, automaton, noise, ML model) is proposed, allowing for the systematization of maze generation approaches based on architectural and functional characteristics. It is established that classical algorithms offer high predictability and performance, while cellular automata and hybrid methods enable the creation of complex, organic, or decorative structures. The scientific novelty of the study lies in the development of a unified classification of maze generation algorithms that consider both structural and gameplay parameters, thus enabling informed choices of optimal solutions for specific game design tasks. The practical significance of this work lies in its applicability to build adaptive level generation systems, creating educational platforms for studying algorithms, and developing recommendation systems for selecting algorithms based on game genre, technical constraints, and desired complexity.
Copyright (c) 2025 Олена Трофименко, Олександр Задерейко, Олег Янковський, Володимир Каіров, Ганна Морозова https://creativecommons.org/licenses/by-nc-sa/4.0
A MODEL FOR FORMATION COGNITIVE SKILLS FOR CYBERSECURITY SPECIALISTS
This article is devoted to the development and theoretical substantiation of a methodology for the formation of cognitive skills in information and cyber security specialists, the implementation of which will allow improving the professional training of specialists and will contribute to increasing motivation in the educational process. The relevance of the problem of training highly qualified cybersecurity specialists is due to the rapid growth of cyber threats, which requires not only technical knowledge of a person, but also developed cognitive skills (critical thinking, the ability to make quick decisions, pattern recognition and stress resistance). By analyzing psychological and methodological literature, the essence and structure of the concept of "cognitive skills", which are critical for information and cybersecurity specialists, are detailed. Based on the problem-activity and personality-oriented approaches, a model of the formation of cognitive skills of cybersecurity specialists has been developed, the main stages of which are diagnostic, formative and control-corrective. Based on the principles of systematicity and professional orientation, a formative block has been defined, which contains a content and activity component. The content part of the methodology covers the scientific and methodological support of disciplines of the specialty F5, software for educational activities and specialized tests in psychology. The activity part of the model is provided by trainings, simulation exercises such as imitation of cyberattacks in the cyber polygon environment, game methods (attacker - security specialists) and cognitive simulators aimed at developing attention, memory, speed of information processing. Pedagogical conditions for the effective implementation of this methodology are outlined, in particular, the readiness and qualification of teachers and technical support. The results of the study can be used by higher education institutions and training centers to modernize curricula and improve the quality of training specialists in the field of information security.
Copyright (c) 2025 Світлана Шевченко , Юлія Жданова, Світлана Спасітєлєва https://creativecommons.org/licenses/by-nc-sa/4.0
STRUCTURE OF HIGH-PERFORMANCE NOSQL DATA MANAGEMENT SYSTEMS
The article explores the architectural foundations of data organization in high-performance NoSQL database management systems, particularly document-oriented ones. It examines the data structure at all levels—from bits and blocks to pages, documents, and collections—forming a unified model of data control. Document-based databases (MongoDB, RavenDB, LiteDB) are shown to provide flexibility, scalability, and high performance through semi-structured storage formats (JSON, BSON), schema-free design, and CRUD operation support. The paper analyzes how data organization, indexing, caching, denormalization, and sharding affect system efficiency. Special attention is paid to index structures such as B-Tree and B-Tree+, transactional mechanisms aligned with ACID principles, and the application of the CAP theorem in distributed environments. A comparative analysis of MongoDB, RavenDB, and LiteDB architectures is presented regarding transaction processing, indexing, scalability, and query handling. The study concludes that a well-designed data organization architecture in NoSQL systems is a key factor ensuring flexibility, performance, reliability, and resilience in modern cloud and distributed data storage infrastructures.
Copyright (c) 2025 Олександр Цируль https://creativecommons.org/licenses/by-nc-sa/4.0
INTEGRATION OF LEAN CANVAS INTO THE TRAINING OF IT SPECIALISTS AS A MECHANISM FOR COGNITIVE SIMPLIFICATION AND RATIONALIZATION OF COMPLEX SOLUTIONS IN THE IT PRODUCT LIFECYCLE
This study is devoted to the integration of the Lean Canvas tool into the training of IT specialists as a mechanism for cognitive simplification and rationalization of complex decisions at the early stages of the digital product life cycle. The theoretical basis is the approaches of hypothesis-driven design and experimental verification of assumptions, which allow minimizing uncertainty and resource-intensive errors in student teams. The aim of the article is to conceptualize the role of Lean Canvas in the educational process in the specialties of "Computer Science" and "Computer Engineering" and to substantiate the methodology of its pedagogical integration into the logic of product management (ideation - MVP - product/market fit). The methodology consists of analysis and synthesis of scientific sources, systemic and activity approaches, modeling of educational artifacts (rubrics, checklists, experiment templates) and empirical testing within curricula focused on team project work. The operational framework for applying Lean Canvas in higher education is presented: mapping of risk hypotheses (problem, segments, value, channels, metrics), forming a test plan, linking with engineering practices (requirements management, CI/CD, UX research), as well as a set of performance indicators (problem-solution fit, conversions, engagement). The scientific novelty lies in the combination of epistemological analysis with the practices of organizational learning of student teams and in the introduction of verified success criteria for educational interventions based on Lean Canvas. The practical significance lies in creating a reproducible methodology for integrating this tool into educational modules on entrepreneurship, product management, and software engineering, ensuring transparency of decisions, traceability of artifacts, and rapid closure of feedback loops. The results can be used to update educational programs, improve the quality of student IT projects, and implement evidence-based innovation management practices in the university environment.
Copyright (c) 2025 Галина Кучаковська, Карина Хорольська https://creativecommons.org/licenses/by-nc-sa/4.0
EVOLUTION OF INTEGRATED INFORMATION SECURITY SYSTEMS AND THE INTEGRATION OF BLOCKCHAIN TECHNOLOGIES IN THE CYBER PROTECTION OF STATE INFORMATION SYSTEMS OF UKRAINE
The article examines the evolution of the concept of Integrated Information Security Systems (IISS) in the context of the digital transformation of the public sector, modernization of the national cybersecurity framework, and harmonization of Ukrainian legislation with international information security standards. The study reveals the relationship between classical approaches to building IISS – based on mandatory certification of technical protection complexes – and the modern paradigm of risk-oriented security management introduced by the new Law of Ukraine No. 4336-IX “On Amendments to Certain Laws of Ukraine on the Protection of Information and Cybersecurity of State Information Resources and Critical Information Infrastructure Objects.” The research emphasizes the shift from a formal certification model to a process-oriented approach based on security profiles, risk management, continuous monitoring, and security auditing. Special attention is devoted to analyzing the potential of blockchain technologies in enhancing the resilience of state information systems against cyberattacks, insider threats, and unauthorized data modifications. The study substantiates the feasibility of using distributed ledgers to ensure the immutability, authenticity, transparency, and accountability of information processes. It is determined that blockchain can serve as an innovative component of the modern IISS architecture, complementing cryptographic protection mechanisms, access control, user activity auditing, and event monitoring. A conceptual model of blockchain integration into the traditional structure of IISS is proposed, forming a new trust ecosystem within state information resources. The combination of technological innovation with the legal requirements of Law No. 4336-IX creates a foundation for improving the effectiveness of the national cybersecurity system. The purpose of the study is to substantiate the scientific, methodological, and technological directions for the modernization of Ukraine’s Integrated Information Security Systems through the integration of blockchain technologies in protecting state information resources in accordance with current legislation and international standards ISO/IEC 27001, ISO/IEC 27701, and GDPR.
Copyright (c) 2025 Valeriia Balatska https://creativecommons.org/licenses/by-nc-sa/4.0
THE EVOLUTION OF CYBER RISK MANAGEMENT THROUGH THE PRISM OF THE NIST CYBERSECURITY FRAMEWORK
The article provides a comprehensive analysis of the evolution of the NIST Cybersecurity Framework from its initial version 1.0 to the current version 2.0. It highlights the background to the creation of the framework, its place in international practice, and its key role in improving the cyber resilience of organizations of all sizes, from small companies to global corporations and government agencies. It examines in detail the features of previous editions, in particular CSF 1.0, which laid the foundation in the form of five basic functions (Identify, Protect, Detect, Respond, Recover), and CSF 1.1, which clarified approaches to risk management in supply chains and made the framework more applicable. It is shown that the transition to CSF 2.0 in 2024 was a qualitative stage of development, as the new version focuses not only on technical aspects but also on strategic corporate governance. Among the key innovations are the Govern function, which formally establishes management responsibility, as well as expanded opportunities for integration with international standards, improved performance metrics, and increased focus on supply chain risk management. The specifics of the transition process for organizations to CSF 2.0 are analyzed separately. It includes analyzing the gaps between the current state of security and the new requirements, forming policies, building an implementation strategy, applying automation and Zero Trust tools, as well as training personnel. It is emphasized that successful adaptation depends on support from senior management, the formation of a security culture, and continuous improvement of procedures. The article also considers the Ukrainian context, where the implementation of CSF 2.0 is supported at the state level by the State Service of Special Communications and Information Protection of Ukraine and with the participation of international partners. The practical value of the study lies in the possibility of using its conclusions and recommendations to develop long-term cyber risk management strategies in both the public and private sectors.
Copyright (c) 2025 Ярина Захарова, Андрій Партика https://creativecommons.org/licenses/by-nc-sa/4.0
METHOD OF SEISMOACOUSTIC MONITORING OF SEPARATE SIGNALS OF EXPLOSIVE FIELDS FOR REMOTE RECONNAISSANCE
The article is devoted to the development and justification of an effective method of remote reconnaissance and monitoring that uses the unique physical characteristics of explosive fields. The need for such a method is driven by the requirement for reliable, all-weather, and covert identification and localization of explosion sources, which is critical for security, military, and engineering reconnaissance. The method considers an explosion as a complex source that simultaneously generates seismic (elastic) and acoustic (infrasonic) signals. The main objective of the work is to present a method of seismoacoustic monitoring of explosive fields, which allows not only to register but also to classify individual signals, generating highly informative data for remote reconnaissance. The methodology is based on the stages of mathematical modeling of seismoacoustic processes. These stages include: determining the physical conditions for signal generation: a detailed analysis of the conversion of explosion energy into seismic waves propagating in the ground and acoustic (shock/infrasonic) waves propagating in the atmosphere; mathematical principles of modeling physical processes: development of a formalized approach to describe the propagation and registration of these waves, taking into account the characteristics of the environment. The main scientific result is the creation and justification of a parametric mathematical model of seismoacoustic monitoring. This model is presented as a superposition of oscillators, where each oscillator is responsible for modeling a specific informative component of the explosion signal. The proposed model allows the informative parameters that directly characterize the explosion field signal (e.g., energy, frequency composition, arrival time, amplitude) to be isolated and quantitatively evaluated. The use of oscillator superposition ensures high model flexibility and its ability to adapt to different types of explosive signals and environmental conditions. The proposed method provides a solid theoretical basis for the construction of automated remote reconnaissance systems. The use of a parametric model in the form of a superposition of oscillators allows for the effective classification and localization of explosive events, distinguishing them from natural and man-made noise. This significantly increases the reliability and informativeness of seismoacoustic complexes, making the method a valuable tool for operational control and strategic monitoring.
FROM AWARENESS TO MANAGEMENT: THE CONCEPT OF HUMAN RISKS IN CYBER SECURITY SYSTEMS
The authors of the scientific article noted that despite the war in Ukraine, society has adapted to the era of information technology, computerization, and automation, with digitalization encompassing all aspects of human life. The concept of the state in a smartphone is increasingly being implemented in various public services for the population. Social services are actively transforming and are even being applied in the military sphere. However, with the growth of digitalization, there is a need to develop countermeasures to strengthen information and cybersecurity, primarily due to the human factor. The purpose of the article is to study the psychological and pedagogical problem of the human factor in ensuring information security and cybersecurity. Research results. The problem of human risk in professional activity is not new. The human factor, patterns, and individual factors that influence professional activity and its impact on the results of activity have been studied by professional psychology theory. In the age of information technology, the human factor is a source of new, previously unseen threats. As modern practice shows, in hybrid warfare, the enemy obtains up to 90% of information through social engineering, receiving valuable information via social networks (Facebook, Telegram channel, Instagram, WhatsApp, Meta, YouTube) that was transmitted through careless conversations. That is why experienced global cybersecurity teams have been thinking about how to reduce human risk in information systems in order to maintain information protection and cybersecurity. This is how the theory of human risk management began, a concept that is established as a separate category, independent of security awareness training. Human resource management promises to deliver a greater return on investment than any other strategic security initiative. The results of the study clearly show the need to implement “human risk management.” Human risk management should focus on results, not just compliance, and quantify the risk associated with human behavior. The theoretical and practical results obtained in the course of scientific research form the basis for further study of various aspects of this issue.
Copyright (c) 2025 Леся Козубцова, Валерій Ліщина, Ігор Козубцов https://creativecommons.org/licenses/by-nc-sa/4.0
METHODOLOGICAL FRAMEWORK FOR THE ATTRIBUTION OF HYBRID AGGRESSION ACTORS IN THE NATIONAL CYBERSPACE
In the context of the ongoing hybrid aggression against Ukraine, the ability to accurately attribute the sources of hostile actions in cyberspace is not merely a technical task but a critical element of national security. This article proposes a solution to the scientific problem of developing a comprehensive methodological framework for the attribution of hybrid threat actors. In the introduction, the author reveals the urgency of the problem, driven by the need for effective counteraction to coordinated cyber and information-psychological operations. An analysis of contemporary research by domestic and foreign scholars shows that existing approaches to attribution are often fragmented, focusing on either technical aspects or content analysis, which necessitates a unified, systemic methodology. The purpose of this work is to develop a holistic methodology for the attribution of hybrid aggression actors, which allows for the integration and synthesis of diverse data to form substantiated conclusions. The theoretical basis of the research includes concepts of hybrid warfare and modern approaches to big data analysis. The methodology involves systemic analysis, the dialectical method, and modeling, which enabled the structuring of the complex, multi-stage attribution process. The key scientific result is the proposed multi-level attribution model, which combines analysis on three levels: technical (analysis of infrastructure, malicious code, and other digital artifacts), tactical (identification of persistent behavioral patterns, tactics, techniques, and procedures), and strategic (analysis of narratives, objectives, and their correlation with the aggressor state's geopolitical interests). The article also formulates a system of criteria for the verification and assessment of the reliability of attribution findings. In the conclusions, the author argues that the proposed model can significantly enhance the evidential value and validity of attribution, providing a deeper understanding of the adversary's strategy. Prospects for further research include the development of applied analytical tools based on artificial intelligence and the study of legal mechanisms for implementing the research results.
Copyright (c) 2025 Ольга Лунгол https://creativecommons.org/licenses/by-nc-sa/4.0
METHODOLOGY FOR DETECTING MALICIOUS CONTENT USING SENTIMENT ANALYSIS
This paper investigates the problem of detecting malicious content in personal electronic communications, such as emails, social media messages, or messengers. Modern systems for filtering malicious content are mainly based on the analysis of keywords, structural features of messages, and technical parameters, such as IP addresses or message origin domains. Such systems have limited effectiveness against modern cyber threats that use message content with emotional manipulation or fake information. In addition, the effectiveness of such approaches is limited, especially when it comes to targeted attacks and new methods of bypassing protection mechanisms that are constantly evolving. The paper proposes a hybrid model, "MaliciousContentDetector," which combines lexical methods, machine learning methods (TF-IDF, Random Forest), and deep learning (BERT) for text sentiment analysis. The model takes into account the linguistic features of the Ukrainian language and contextual emotional triggers. The proposed model is also implemented as a software which may be integrated into into browsers and other applications to enhance the cybersecurity of end-users. The developed model was tested on real messages from a popular news channel on a social network. During the analysis of 162 posts in that news channel, the "MaliciousContentDetector" model showed high efficiency and accuracy in detecting potentially malicious text content.
Copyright (c) 2025 Дмитро Андрушко, Дмитро Шедін , Вадим Чакрян https://creativecommons.org/licenses/by-nc-sa/4.0
THE DIGITAL TRANSFORMATION OF COMPETENCY ASSESSMENT: CHALLENGES AND FUTURE OF INTELLIGENT SYSTEMS
This article is devoted to the conceptual substantiation of an intelligent information system for competency assessment as an instrument for overcoming the limitations of traditional approaches and ensuring individualization of the educational process in the context of digitalization of higher education. The study addresses the global problem of the gap between competency-based approach requirements and existing assessment tools that fail to meet the needs of educational process individualization. The limitations of traditional learning management systems (LMS) are analyzed, which demonstrate significant deficiencies in their ability to analyze qualitative information and ensure system adaptability to the individual needs of learners. The theoretical framework of the research defines the essence of competency as a complex dynamic set of professional knowledge, skills, abilities, and value orientations, substantiates the principles of competency assessment, and reveals the characteristics of intelligent systems as a new class of automated information processing systems. A conceptual architecture of an intelligent information system for competency assessment has been developed, integrating multiple data sources, complex analytical modules, and adaptability mechanisms. The research findings demonstrate the unique capabilities of intelligent information systems in conducting deep semantic analysis, generating personalized recommendations, adapting learning materials, and providing comprehensive competency assessment. The application of neural network technologies, decision support systems, and natural language processing in the context of competency assessment is examined in detail. The main limitations and challenges of implementing intelligent systems are analyzed, including the complexity of modeling creative activities, the "black box" problem, data quality requirements, and information security assurance. The conceptual substantiation of the system demonstrates its potential as an effective tool for enhancing educational process quality through individualization, personalization, and continuous improvement of educational practices. The proposed cognitive technology for competency development integrates an individualized approach to learning and ensures a cyclical process of continuous competency development for learners. The intelligent information system represents a paradigm shift toward more sophisticated, adaptive, and learner-centered assessment methodologies that align with contemporary educational imperatives and technological capabilities.
Copyright (c) 2025 Олександр Харченко, Дмитро Бондаренко https://creativecommons.org/licenses/by-nc-sa/4.0
THE ESSENCE OF UKRAINE'S CYBER DEFENSE: DEFINITION AND CONTRADICTIONS OF LEGAL AND THEORETICAL PRINCIPLES
Since the beginning of the Russian Federation’s hybrid aggression in 2014, and especially after the full-scale invasion in 2022, Ukraine has become the target of large-scale cyberattacks aimed at critical infrastructure and information systems of state institutions. The available statistics of cyberattacks confirm the Russian Federation’s intentions to “capture” Ukraine’s cyberspace by any means in order to achieve a strategic advantage in an armed conflict. Accordingly, Ukraine’s tasks are to protect its own cyberspace and create conditions for active actions in the enemy’s cyberspace. The article examines the essence of Ukraine’s cyber defense in terms of fundamental definitions according to the Laws of Ukraine “On the Basic Principles of Ensuring Cybersecurity of Ukraine”, “On the Defense of Ukraine” and relevant regulatory legal acts. The analysis identifies contradictions in the theoretical and legal foundations of cyber defense, and emphasizes the lack of a clear legislative definition of the term “cyber defense”. It is emphasized that no regulatory legal act defines the structure of the state cyber defense system, the composition and tasks of the entities providing it, as well as the objects of cyber defense. Some issues are partially outlined in the draft Law on the Cyber Forces of the Armed Forces of Ukraine, however, its provisions contain discrepancies with the current legislation and consider cyber defense in a “narrow” sense. All of the above complicates the formation of state policy in the field of cyber defense, and accordingly, the implementation of the cyber defense system. Attention is focused on the need to harmonize legal and regulatory definitions from the standpoint of a systemic approach, to separate cyber defense into a separate sphere with the adoption of the basic law “On Cyber Defense of Ukraine”, which will determine the principles of state policy, ensure the harmonization of the legal field and contribute to the implementation of the state’s strategic goals in the field of cyber defense.
Copyright (c) 2025 Світлана Паламарчук, Наталія Паламарчук, Роман Штонда, Тетяна Побережець https://creativecommons.org/licenses/by-nc-sa/4.0
LOGICAL-STRUCTURAL MODEL OF A COMPUTER-BASED PROCEDURE FOR THE SUPPORT SYSTEM FOR NPP OPERATIONAL PERSONNEL
This article develops a logical-structural model of a computer-oriented procedure for normal operation and elimination of violations for the support system for NPP operational personnel. The purpose of this study is to create a model of a computer-oriented procedure, the data structures of which will comply with technological regulations and instructions for NPP operational personnel and contain information about the relationship between states and steps of procedures. The object of the study is the process of forming computer-oriented procedures for controlling a NPP power unit. The subject of the study is logical-structural models of computer-oriented procedures and methods for identifying states and steps of procedure execution based on production rules. The following tasks were solved in this study: the data structure of the computer-oriented procedure model was developed, which complies with current regulations and instructions; a logical-structural model of a computer-oriented procedure was created, which will be used to create support systems for NPP operational personnel; A method for identifying the conditions for entering the procedure and performing its steps has been developed. The model is designed to solve the problem of maintaining relevance, early identification of the states of the power unit and its equipment, ensuring the possibility of obtaining information about the state of technological parameters with the required level of reliability and accuracy. The proposed model can be used to create support systems for operational personnel managing complex technological facilities using specific procedures and instructions.
Copyright (c) 2025 Борис Вінтенко , Ірина Миронець , Олексій Смірнов, Олександр Коваленко , Павло Усік , Костянтин Буравченко , Ірина Лисенко https://creativecommons.org/licenses/by-nc-sa/4.0
PREDICTING CVE EXPLOITATION BASED ON NVD AND KEV OPEN DATA FOR RISK-ORIENTED PRIORITIZATION
With the increasing number of publicly disclosed software vulnerabilities, security teams are increasingly challenged to identify key issues that require urgent remediation. While systems such as the Common Vulnerability Scoring System (CVSS) provide severity ratings, they do not indicate whether a vulnerability will be exploited in practice. The study proposes a machine learning-based approach to predict exploitable vulnerabilities using structured public data from the National Vulnerability Database (NVD) and the CISA-maintained Catalog of Known Functional Vulnerabilities (KEV). A labeled dataset of over 300,000 CVEs is generated, where randomly exploited ones are identified by KEV. The extracted features include CVSS vectors, CWE identifiers, vendor/product metadata, and time characteristics. Due to the extreme class imbalance (exploited CVEs are ~0.45%), an oversampling method and decision threshold tuning are used. Logistic regression trained in ML.NET is used to build interpretable models; it learns meaningful patterns that distinguish between exposed vulnerabilities. The threshold spectrum scoring demonstrates high completeness and increasing accuracy, offering a transparent and reproducible tool for prioritization. Additionally, the limitation associated with incomplete KEV as a “source of truth” is addressed and directions for improvement are directed: integration of NLP-embedding of CVE descriptions, probability calibration, and time-based validation to prevent data leakage. This approach increases the risk-based nature of cybersecurity decisions and can be otherwise integrated into vulnerability management processes in organizations of various scales.
Copyright (c) 2025 Владислав Денисюк https://creativecommons.org/licenses/by-nc-sa/4.0
PANDAS FOR DATA MANAGEMENT IN TARGETING SETUP PROJECTS
The article examines the application of the Pandas library as the main tool for managing input, internal, and output data in time series forecasting projects within the field of targeted advertising campaigns. An approach is presented for organizing the process of collecting, processing, and analyzing large volumes of marketing data obtained from CRM systems, advertising platforms, and web analytics. The study outlines the stages of data cleaning from missing values and duplicates, unifying time formats, generating aggregated indicators, and creating new features for subsequent machine learning. Particular attention is paid to the preparation of intermediate metrics such as moving averages, standard deviations, seasonality coefficients, and trend components, which provide a deeper understanding of user behavior over time. For modeling and forecasting audience activity, ARIMA, Prophet, and LSTM algorithms are used, demonstrating varying sensitivity to trends, seasonal fluctuations, and short-term anomalies. Code examples, table fragments, and visualizations of results demonstrate that Pandas provides high flexibility in working with time series, simplifies the creation of data processing pipelines, and enhances the transparency of analytical processes. The results prove the effectiveness of integrating Pandas into marketing decision-making systems, as more accurate forecasting of clicks, impressions, and conversions contributes to budget optimization and increases the profitability of advertising campaigns. A promising direction for further research is the expansion of forecasting models by combining Pandas with deep learning libraries and automating analytical processes. Additionally, it is advisable in future work to develop integrated Pandas-based dashboards for real-time monitoring of forecasting results, which will ensure operational analytics and improve the adaptability of marketing strategies.
Copyright (c) 2025 Оксана Онищук https://creativecommons.org/licenses/by-nc-sa/4.0
ADAPTIVE METHODS TO COUNTER ACTIVE NOISE JAMMING
The effectiveness of performing a flight mission by an unmanned aerial vehicle at a given distance crucially depends on the quality of control, telemetry control and data transmission by the unmanned aerial vehicle, which, in turn, are determined by the quality of radio communication between the ground control station and the unmanned aerial vehicle. At the same time, modern military radio-electronic systems operate, as a rule, in a complex radio-electronic environment, caused by the influence of both internal and external interference, as well as enemy electronic suppression means. Active interference of various types and purposes is used, aimed at disabling control channels, navigation channels, telemetry channels and data transmission channels of unmanned aerial vehicles, in particular FPV drones, which necessitates the search and implementation of new countermeasure methods capable of ensuring the stable functioning of unmanned aerial vehicles and FPV drones in conditions of active information confrontation. The article considers modern approaches to counteracting active noise interference in FPV drone control systems. The relevance of the problem is substantiated, due to the increasing scale of the use of unmanned aerial vehicles in the military and civilian spheres, as well as increasing the effectiveness of electronic jamming. Traditional protection methods are analyzed and their limitations in dynamic conditions of information warfare are identified. The results of the study of adaptive LMS and RLS filters, spatial signal selection methods (MVDR, LCMV), as well as the use of machine learning algorithms for detecting and neutralizing jamming signals are presented. It is shown that the combination of adaptive and intelligent methods provides increased stability of communication channels and reduces the risk of loss of drone control. The conclusion is made about the feasibility of using hybrid solutions that integrate classical digital signal processing algorithms with artificial intelligence methods.
Copyright (c) 2025 Лариса Крючкова, Нікіта Ворохоб https://creativecommons.org/licenses/by-nc-sa/4.0
METHOD FOR CALCULATING THE LEVEL OF CYBERSECURITY OF CRITICAL INFORMATION INFRASTRUCTURE FACILITIES
In today's world, where the number and complexity of cyber threats, especially those targeting strategic state assets, are growing rapidly, there is an urgent need to develop effective, flexible, and adaptive mechanisms for assessing the current level of cyber security. In view of this need, an analysis of existing approaches to assessing the level of cyber security was conducted. Among them are models based on maturity, risk, and compliance. The results of the analysis showed that none of these approaches is completely universal or sufficient for a comprehensive assessment of critical information infrastructure objects in the context of the national legislative field. In particular, approaches based solely on compliance may not take into account real risks, while approaches based on maturity are often too subjective. To address these systemic shortcomings, a hybrid approach was proposed. This approach integrates the best features of previous models, combining the objectivity of compliance testing, the flexibility and process orientation of maturity assessment, and risk-based prioritization. Based on the hybrid approach, a method for calculating the level of cyber protection of critical information infrastructure objects was developed. A component of this method is the introduction of weighting coefficients for different criteria systems. To determine these weighting coefficients, which should ensure an objective reflection of expert knowledge, the hierarchy analysis method was chosen. The proposed method allows qualitative characteristics (e.g., binary “yes/no” answers) to be transformed into a single quantitative indicator. This indicator is calculated in a standardized range from 0 to 1, which facilitates comparison and monitoring. The resulting numerical value is further interpreted on a five-level maturity scale (from “Initial” to “Optimized”), which provides a clear idea of the steps needed for improvement. Thus, the developed method is hierarchical, multi-criteria, and adaptable to current Ukrainian legislation in the field of cyber protection and cyber security. In further research, it is planned to conduct an experimental study and verify the method on three critical infrastructure objects in the fuel and energy sector, as well as to compare the results obtained using the author's software and two other tools.
Copyright (c) 2025 Діана Юдіна https://creativecommons.org/licenses/by-nc-sa/4.0
COOPERATIVE UAV DETECTION USING V2X INFRASTRUCTURE IN RURAL DEFENSE CORRIDORS: STRENGTHENING CONNECTIVITY FOR DUAL-USE APPLICATIONSADVERSARIAL TACTICS FOR DETECTION EVASION
Rural transport corridors have sparse radar coverage and constrained backhaul, which increases the risk of small-UAV incursions. A dual-use approach is proposed in which V2X roadside units (RSUs) perform cooperative RF sensing without degrading ITS functions. The architecture combines a communications subsystem for transport services with a sensing subsystem that provides multiband monitoring, sub-threshold correlation, and adaptive thresholds. The processing pipeline has three stages: local observation, inter-station correlation of weak detections, and distributed triangulation for direction and position estimation. Control messages are exchanged over the service channel with GPS time synchronization. The models account for airborne path-loss and cooperative SINR gain under interference. Validation with Monte Carlo simulations for a long corridor of evenly spaced RSUs shows higher detection probability and better azimuth accuracy than isolated nodes. Parametric studies over RSU spacing, cooperation-window size, and detection thresholds confirm consistent cooperative gain and identify boundary regimes. The system is resilient to single-node failures due to coverage overlap, but is limited for non-emitting UAVs, under heavy interference, and at corridor edges. Practical value lies in creating a cost-efficient early-warning network in sparsely populated regions and integrating with C2 systems to raise situational awareness. Planned work includes field trials, multisensor integration, and AI-based trajectory prediction.
METHOD FOR ENHANCING THE SECURITY LEVEL OF THE STATE’S CRITICAL INFORMATION SYSTEMS
In today's conditions of increasing cyber threats and the complexity of technological systems, ensuring the security of critical information systems (CIS) is one of the key tasks of national security of the state. Existing approaches to assessing the state of CIS security are mainly focused on individual technical or organizational aspects, which does not provide comprehensive consideration of the relationships between risk, reliability and stability. The article presents a method for increasing the level of CIS security, which involves formalizing the relationships between these parameters in the form of a system of mathematical expressions and introducing an integral indicator of the level of security. The proposed approach allows quantitatively assessing the current state of CIS security, predicting the impact of potential threats and determining optimal strategies for increasing stability, taking into account limited resources. The developed method ensures objective decision-making on risk management and increasing the effectiveness of CIS protection and contributes to the formation of an adaptive national cybersecurity system. Further research involves experimental testing and verification of the proposed method on examples of the functioning of critical infrastructure objects of various industries to assess its effectiveness, versatility and possibility of practical implementation.
Copyright (c) 2025 Вікторія Сидоренко, Сергій Сидоренко https://creativecommons.org/licenses/by-nc-sa/4.0
PSYCHOLOGICAL METHODS OF FRAUD IN CYBERSPACE AND WAYS TO COUNTER THEM
The article examines the methods of social engineering used by attackers to gain unauthorized access to confidential information and manipulate the behavior of victims. The main types of attacks, such as phishing, vishing, smishing, pretexting, spear-phishing and whaling, as well as their features, implementation mechanisms and methods of deceiving users, are considered. Particular attention is paid to the psychological aspects of social engineering, including the influence of fear, trust, urgency, social proof and cognitive biases on the decision-making process. Modern approaches to protection against social engineering attacks are outlined, which include a combination of technological and educational methods. Measures are proposed to increase the digital literacy of users, develop information security policies, use multi-factor authentication, user behavior analysis systems and artificial intelligence to detect threats. Particular attention is paid to the use of large language models to identify fraudulent schemes and automate cybersecurity. The results of the study indicate the need for a comprehensive approach to protection against social engineering attacks, which involves synergy between technological tools and the human factor. The proposed recommendations are aimed at minimizing risks and increasing the overall level of security in the digital environment.
Copyright (c) 2025 Олег Гарасимчук, Юлія Оліярник, Андрій Нестор, Тарас Наконечний https://creativecommons.org/licenses/by-nc-sa/4.0
INTEGRATION OF OPERATIONS RESEARCH AND DISCRETE MATHEMATICS METHODS FOR PROCESS OPTIMISATION IN OPERATING SYSTEM SOFTWARE
The article presents an approach to optimizing processes in operating system software based on the integration of operations research (OR) and discrete mathematics (DM) methods. It is shown that modern operating systems operate in high-parallelism environments where processes compete for limited resources, which necessitates the search for optimal allocation strategies. Game theory, as a component of OR, provides a framework for modeling strategic interactions among processes, while discrete mathematics offers formal tools for describing structural relationships between them. A game-theoretic model of process scheduling optimization is proposed, where each process is considered a player with a utility function depending on execution time, resource volume, and priority. The application of Nash equilibrium enables finding a stable resource distribution without centralized control. A generalized mathematical model is developed in the form of a directed graph, implementing optimal scheduling algorithms based on dynamic programming, linear optimization, and graph theory. Comparative analysis between classical scheduling algorithms (FCFS, Round Robin, Priority) and the proposed game-optimization model demonstrates reduced average waiting time and improved CPU utilization. The obtained results confirm the efficiency of the integrated approach and highlight its potential application in modeling cloud and distributed systems. The proposed methodology can also be used in educational practice when teaching courses such as Discrete Mathematics, Operations Research, and Operating Systems.
Copyright (c) 2025 Тетяна Бажан, Вікторія Жебка, Ірина Гніденко, Олена Волощук https://creativecommons.org/licenses/by-nc-sa/4.0
WEB PROGRAMMING AND MOBILE DEVELOPMENT: UX/UI SOLUTIONS FOR PROTECTING USERS' PERSONAL DATA
With the rapid expansion of digital platforms and the centrality of online services in everyday life, the issue of protecting users' personal data has become a critical aspect of human-computer interaction. Traditional approaches that reduce data protection to legal compliance and technical security measures have proven insufficient for ensuring genuine user privacy. This has led to the emergence of systematic UX/UI methodologies designed to integrate data protection principles directly into the user experience. The present study introduces an authorial framework – the Privacy-Embedded User Journey (PEUJ) – which unites contextual consent, proactive nudges, transparent data control, and iterative feedback loops. Experimental validation was conducted on three types of digital services (FinTech application, e-commerce platform, and health & fitness tracker), enabling the measurement of informed consent rates, user trust scores, frequency of privacy settings usage, incidence of excessive data sharing, user retention rates, and a composite Privacy-Usability Index (PUI). The findings reveal that the application of the PEUJ framework systematically increases informed consent by 22–35 percentage points, improves user trust by 18–28%, reduces excessive data sharing by 25–40%, and increases user retention by 8–12 percentage points. Particular attention is devoted to the role of embedding privacy interventions into key interaction points rather than relying on post-factum compliance, which is shown to enhance both user autonomy and business metrics. The study further highlights the potential of employing the Privacy-Usability Index (PUI) as a unified metric for evaluating and comparing privacy-focused UX interventions across domains. These insights underscore the importance of rethinking data protection as an integral element of user experience that ensures both ethical compliance and commercial viability [1, 2].
Copyright (c) 2025 Вадим Читулян, Іван Олейніков, Олексій Ананченко, Вадим Дзюба https://creativecommons.org/licenses/by-nc-sa/4.0
INTEGRATED APPROACH TO THREAT MODELING IN ARTIFICIAL INTELLIGENCE SYSTEMS
This paper substantiates the relevance of threat modeling for artificial intelligence (AI) systems in the context of increasing model autonomy and the emergence of new attack vectors. It demonstrates that traditional methods fail to account for the specific nature of AI, creating the need for a comprehensive approach capable of covering the entire system lifecycle. The methodological foundation of the integrated approach combines international standards and industry best practices: ISO/IEC 42001:2023 ensures governance and auditing, NIST AI RMF 1.0 defines the process cycle Govern–Map–Measure–Manage, MITRE ATLAS enriches models with realistic attack scenarios, CSA MAESTRO introduces multi-layer architectural decomposition, and OWASP GenAI Security Project provides operational artifacts and prioritization tools. This synthesis enables the integration of strategic policies, technical taxonomies, and practical playbooks into a single managed process. The proposed approach makes threat modeling continuous and evidence-based, ensuring traceability from threat identification to control implementation and performance metrics. It addresses both technical and socio-technical risks, including impacts on users and society, and supports profile-specific adaptation for various system types—from LLMs to agent-based platforms. Integration with CI/CD pipelines and automation of security checks improves response speed and reduces security costs. The scientific novelty lies in forming a holistic vision that combines governance, process discipline, architectural analysis, and operational instruments. The practical significance is in the ability to apply this approach to develop comprehensive protection strategies aligned with international standards and suitable for certification audits. The integrated approach establishes a foundation for large-scale AI deployment with proven security and trust during threat modeling. It not only enhances system resilience but also creates a standardized risk management framework that meets modern cybersecurity challenges.
Copyright (c) 2025 Тарас Крет, Євгеній Марценюк https://creativecommons.org/licenses/by-nc-sa/4.0
METHOD OF LEARNING OF AUTONOMOUS MOBILE ROBOTS BASED ON DRL AND CURRICULUM LEARNING
The work is devoted to the urgent task of improving the efficiency of socially adaptive navigation of autonomous mobile robots in dynamic environments with human presence. The application of deep reinforcement learning (DRL) methods to solve this problem is complicated by the high dimensionality of the state space, the complexity of formalizing social norms in the reward function, and the instability of the learning process. To overcome these challenges, a method is proposed that integrates the Proximal Policy Optimization (PPO) algorithm with the Curriculum Learning (CL) training strategy. The developed training program combines a gradual increase in the complexity of the environment (from static obstacles to an environment with moving human agents) and the phased formation of the reward function with the addition of social components. A key feature is the transition between stages, which is based on policy stability analysis. The experimental study was conducted in the developed Gazebo simulation environment using the Turtlebot3 Waffle mobile robot and the ROS 2 Humble framework. Step-by-step training allows an autonomous mobile robot to first learn basic skills for avoiding static obstacles, then dynamic ones, and finally, at the final stage, to take into account social norms of interaction with people. The input data for the system is data from LiDAR, the status of the robot and people, and the target position. The result of the method is an optimized stochastic behavior policy that allows an autonomous mobile robot to make safe, efficient, and socially acceptable navigation decisions. A comparative analysis of the proposed method with the standard PPO algorithm was performed. The results confirm that the proposed method allows the formation of an effective policy of socially adaptive navigation, solving the problems of instability and slow convergence.
Copyright (c) 2025 Людмила Ганенко, Олександр Бушма https://creativecommons.org/licenses/by-nc-sa/4.0
DLP SYSTEM AS A COMPONENT OF COUNTERING INSIDER THREATS TO INFORMATION CONFIDENTIALITY
Information security threats, particularly data leaks caused by employee actions, are increasing every year and pose a serious risk to organizations. The consequences of such threats can be devastating, as employees' existing access to information assets and their knowledge of security controls complicate detection and significantly increase the time required to respond to a security incident. One of the most well-known means of preventing internal information security threats is Data Loss Prevention (DLP) systems. The capability to fine-tune rules for tracking sensitive data across the network helps prevent instances where an employee disseminates confidential data due to carelessness or a lack of awareness. Nevertheless, a DLP solution may prove ineffective against motivated insiders who can exploit security control flaws, such as the inability to inspect an encrypted file for sensitive data. This article explores ways to enhance the efficacy of DLP systems against the intentional theft and distribution of restricted information. This is achieved through the continuous interaction of Data Loss Prevention with other security controls, such as access management, user activity analytics, and an organizational corporate culture focused on ensuring information security. An analysis of modern DLP systems was conducted, and criteria were defined for selecting a solution that would best cover the organization's information infrastructure and ensure a comprehensive approach to data protection. The author emphasizes the importance of integrating Data Loss Prevention and User Activity Monitoring (UAM) for the timely detection of and response to suspicious user behavior. The practical implementation of combining DLP and UAM is examined using the example of the Teramind software suite, whose functionality provides not only full control over data usage within the organization's network but also simplifies the process of responding to confidential information leakage incidents. The research results include the development of recommendations for increasing the effectiveness of DLP systems in countering insider threats.
Copyright (c) 2025 Галина Гайдур, Віталій Марченко, Юрій Борсуковський, В'ячеслав Дмітрієв, Софія Царьова https://creativecommons.org/licenses/by-nc-sa/4.0
METHODS AND MODELS OF COUNTERING GROUP CYBER THREATS BASED ON ARTIFICIAL INTELLIGENCE
The article addresses the pressing issue of countering group threats in the field of cybersecurity, which are characterized by a high level of organization, complex structures, and targeted execution. With the advancement of digital technologies and the growing dependency of businesses and government institutions on information systems, threats carried out by coordinated groups-such as APTs, botnets, and other cybercriminal organizations-pose an increasing danger. Traditional security approaches have proven ineffective against such attacks, as they often fail to consider the dynamic behavior of threats, their rapid evolution, and adaptability to defensive mechanisms. A method for countering group threats based on artificial intelligence technologies is proposed, specifically leveraging machine learning, deep learning, and big data processing techniques. The developed model architecture enables the detection of signs of coordinated malicious activity, analysis of attacker behavioral patterns, and timely response to potential threats. Special attention is given to the development of adaptive models capable of real-time self-learning and identifying atypical deviations from the normal functioning of an information system. The models are designed with key characteristics of group attacks in mind, including scenarios of distributed attacks, hidden communication between attackers, and the use of encryption and evasion techniques. Experimental studies on the effectiveness of the proposed approach were conducted using test datasets and realistic threat scenarios. The results demonstrated high detection accuracy, a reduction in false positives, and improved response times compared to traditional systems. The findings confirm the feasibility and effectiveness of using intelligent methods to counter complex group threats. The proposed method and models can be integrated into existing cybersecurity monitoring systems to enhance their resilience against modern attacks. The article also outlines prospects for further research, particularly in improving model training methods and scaling to large corporate networks.
Copyright (c) 2025 Володимир Шульга, Євгенія Іванченко, Тетяна Берестяна, Олексій Шкурченко https://creativecommons.org/licenses/by-nc-sa/4.0
INFORMATION TECHNOLOGY OF DYNAMIC FREQUENCY RESOURCE MANAGEMENT IN COMPLEX RADIO-ELECTRONIC ENVIRONMENT
The article proposes an advanced information technology for dynamic frequency resource management under complex radio-electronic conditions, where spectrum scarcity, high user density, and intentional electronic countermeasures create critical challenges. The developed model integrates the flexibility of software-defined radio (SDR) with the adaptive intelligence of cognitive radio, enabling autonomous detection of free frequency bands, resistance to interference, and rapid reconfiguration of transmission parameters. The functional basis of the approach is the “observation–analysis–decision–adaptation” cycle, which has been implemented in the GNU Radio environment with the use of SDR platforms such as USRP. Within this framework, the system continuously monitors the radio spectrum, applies spectral analysis methods, and adapts transmission according to real-time assessments of interference and noise levels. Special emphasis is given to the application of machine learning algorithms, including Q-learning, which provide the system with the capability to accumulate operational experience and improve decision-making efficiency in highly dynamic environments. Such mechanisms ensure a reduction of reaction time to less than 250 ms, allowing the system to instantly switch to optimal frequencies. Experimental validation confirmed that the proposed methodology maintains the bit error rate (BER) at levels below 10⁻⁴ and keeps average packet losses within 5–7%, even under strong jamming and hostile spectrum congestion. Additionally, the system achieves uniform spectrum utilization, which prevents the overload of specific frequency bands and reduces the risk of conflicts with other users. The research builds upon the pioneering works of J. Mitola and S. Haykin, who defined the theoretical foundations of cognitive radio and its learning-based adaptation cycle. It also incorporates findings by Zhou, Wang, Steyn, Pratt, as well as Ukrainian researchers Popov, Zaitsev, and Trysnyuk, who contributed to the study of SDR-based adaptive systems in the context of security and electronic warfare. The obtained results demonstrate that the proposed methodology not only increases resilience and efficiency of communications but also enables cost-effective virtual testing of electronic warfare scenarios, reducing the need for large-scale field experiments. The approach is particularly relevant for military applications, where reliable communications under hostile radio-electronic conditions are critical. At the same time, it provides perspectives for use in civilian domains with congested spectrum environments.
Copyright (c) 2025 Василь Триснюк, Володимир Дзюба https://creativecommons.org/licenses/by-nc-sa/4.0
ADAPTIVE SPECTRAL MANEUVERING IN CONTROL SYSTEMS OF ROBOTIC COMPLEXES UNDER ELECTRONIC WARFARE CONDITIONS
The article presents an approach to enhancing the interference resistance of control radio channels for robotic systems under conditions of active electromagnetic disruption by introducing a mechanism of adaptive spectral maneuvering. The proposed simulation model is implemented on an SDR-based platform and incorporates elements of cognitive spectrum analysis, enabling dynamic adjustment of signal frequency-time parameters in response to deteriorating radio conditions. The model includes modules for spectrum monitoring, interference detection, channel quality evaluation (BER, SNR), and an adaptive frequency control unit. Simulation results demonstrate a significant reduction in error probability and sustained system operability compared to statically configured channels. The proposed solution is applicable in logistics, technical monitoring, and unmanned surveillance systems, particularly in environments with intentionally congested spectrum.
Copyright (c) 2025 Сергій Семендяй https://creativecommons.org/licenses/by-nc-sa/4.0