SYNERGISTIC ARCHITECTURE FOR AUTOMATED DETECTION OF TARGETED INFORMATION ATTACKS

Abstract

Detecting targeted attacks in order to counteract them in a timely manner requires an operational analysis of the information space using specialized monitoring systems. Such systems should provide not only hardware analysis of information attacks, but also quantitative analysis of the dynamics of these attacks, taking into account their specifics. In the event of an attack, the intensity of incidents of the attack flow, which is a time series by the number of information incidents over a certain period of time (usually per day), may contain information both about the fact of a targeted attack and about the phase of the scenario in which it is carried out. It is noted that the current detection of information security threats is mainly a manual process in which teams of analysts monitor suspicious events using auxiliary tools. The ability of analysts to recognize suspicious activity and the authority to make decisions about threats put people at the centre of the threat detection process. It is noted that excessive reliance on human abilities can lead to a large number of undetected threats. The author substantiates the need for a new detection paradigm that would be largely automated, but in which analysts would retain situational awareness and control over the process. The article proposes a synergistic detection process that rationally uses the advantages of human cognition and machine computing, while mitigating their weaknesses. The paper presents the structure of analyst discovery in the cycle and describes the types of required interactions between the evidence collection system, inference engine, and analyst. the paper presents the structure of analyst discovery in the cycle and describes the types of required interactions between the evidence collection system, inference engine, and analyst. The use of queries and operations to improve detection is demonstrated and the basis for a more detailed operational definition of interactions is laid.