MULTILEVEL ARCHITECTURE FOR BEHAVIORAL ARTIFACT COLLECTION IN HETEROGENEOUS NETWORKS TO FORM DIGITAL FOOTPRINTS

Abstract

The object of research is the process of generating a digital evidence array within heterogeneous information and communication systems under post-quantum cyber threats. The subject of research encompasses architectural solutions and methods for the multilevel collection of behavioral artifacts for decision support systems (DSS). The relevance of this work stems from the need to develop alternative security verification methods for network nodes in cases where current cryptographic identification (TLS, PKI) may be compromised by an adversary with access to quantum resources. Unlike existing methods focused on analyzing individual log types, this paper proposes the concept of a sensor hierarchy covering the network, system, and application levels of the infrastructure. The scientific novelty of the results lies in the formalization of the procedure for transforming disparate raw security events into structured "digital footprints." Specifically, a multilevel monitoring architecture has been developed, enabling flexible adjustments to the intensity of artifact collection depending on the network segment type and the predicted attack vector (EDoS impacts, Supply Chain Attacks). For the first time, a methodology for weighting behavioral features based on their informativeness is described, ensuring the minimization of computational costs for data processing while maintaining high reliability in forming input parameters for game-theoretic security models. The practical significance of the work lies in the development of software module structures for data aggregation that can be integrated into existing SIEM/IDS platforms. The implementation of the proposed architecture using the Python language has enabled the automation of detecting anomalous deviations in node behavior, even when digital certificates formally remain valid. Experimental validation of the architecture confirmed its ability to ensure the integrity of the DSS information base, even under conditions of changing heterogeneous environment topology and significant network noise levels.