Cybersecurity: Education, Science, Technique

Journal Information
EISSN : 2663-4023
Current Publisher: Borys Grinchenko Kyiv University (10.28925)
Total articles ≅ 118
Current Coverage

Latest articles in this journal

Serhii Tolіupa, Oleksandr Pliushch, Ivan Parkhomenko
Cybersecurity: Education, Science, Technique, Volume 2, pp 169-183; doi:10.28925/2663-4023.2020.10.169183

Systems for detecting network intrusions and detecting signs of attacks on information systems have long been used as one of the necessary lines of defense of information systems. Today, intrusion and attack detection systems are usually software or hardware-software solutions that automate the process of monitoring events occurring in an information system or network, as well as independently analyze these events in search of signs of security problems. As the number of different types and ways of organizing unauthorized intrusions into foreign networks has increased significantly in recent years, attack detection systems (ATS) have become a necessary component of the security infrastructure of most organizations. The article proposes a software prototype of a network attack detection system based on selected methods of data mining and neural network structures. The conducted experimental researches confirm efficiency of the created model of detection for protection of an information network. Experiments with a software prototype showed high quality detection of network attacks based on neural network structures and methods of intelligent data distribution. The state of protection of information systems to counter cyber attacks is analyzed, which made it possible to draw conclusions that to ensure the security of cyberspace it is necessary to implement a set of systems and protection mechanisms, namely systems: delimitation of user access; firewall; cryptographic protection of information; virtual private networks; anti-virus protection of ITS elements; detection and prevention of intrusions; authentication, authorization and audit; data loss prevention; security and event management; security management.
Andrii Halchenko, Sergiy Choporov
Cybersecurity: Education, Science, Technique, Volume 2, pp 29-44; doi:10.28925/2663-4023.2020.10.2944

The deniable encryption algorithms productivity increasing is investigated in this paper. This investigation is relevant because of effective schemes for information and its users protection. But these algorithms is very complex and lumped. It really affects them. That's why deniable encryption algorithms have not been widespread in data processing and information security systems. The execution time reducing methods and tools exploration is the main goal of this work. The divide and conquer method has been discussed and investigated in this paper. It has been implemented into the data processing system of the deniable encryption algorithms. Nothing modifies have been implemented into the base algorithm. It allows to make it universal and apply to other deniable encryption algorithms. The series of experiments have been completed by authors to verify the hypothesis. The base deniable encryption algorithm discussing is the first stage of investigation. Its vulnerabilities have been found and investigated. Another algorithm is based on the divide and conquer method applying. It has been implemented into the modified data processing system. The both algorithms efficiency has been investigated by the experiments with the real with public and secret information files. The experiments have been completed on the prepared equipment. This equipment simulates the user's workplace with real hardware and software. According to the results the deniable encryption algorithms productivity has been reached by the divide and rule method. Also the method has been verified by the different size encryption keys. The base deniable encryption algorithms have not been modified. The results have been compared with other authors' investigations. In the end authors' hypothesis has been proved. But some restrictions of this results reaching have been set by the authors.
Iryna Litvinchuk, , Maksym Vorokhob
Cybersecurity: Education, Science, Technique, Volume 2, pp 135-143; doi:10.28925/2663-4023.2020.10.135143

The article is devoted to the development of a method for evaluating the effectiveness of the level of protection at the object of information activities when using an integrated security system. Such systems provide for the sharing of resources of subsystems of fire and security alarm, video surveillance, access control systems and others. The application of integration provides a number of benefits, including: quick and accurate reaction to events, facilitating the work of the operator by automating management processes, control and decision-making on security, reducing the probability of erroneous actions of the operator, reducing equipment costs. Among the requirements for integrated security systems are reducing the role of man in the security process by increasing the systems intelligence, reducing the level of false positives due to closer use of subsystems and openness. Implementation of these requirements will increase the efficiency of security systems, reduce the human factor and will make the construction of integrated systems more transparent. The proposed method of assessing the integrated security system summarizes the state of security at the object of information activities, points to the weaknesses of the existing integrated security system, those that need of improvement. It can also be used when selecting the appropriate integrated security system. The assessment of the level of protection takes into account such criteria as complexity, functionality, size, speed, fault tolerance, scalability, interaction with external systems, the possibility of expansion.
Hennadii Hulak, , , Lydia Kuzmenko
Cybersecurity: Education, Science, Technique, Volume 2, pp 6-28; doi:10.28925/2663-4023.2020.10.628

This paper examines the security threats to guaranteed information systems, as well as measures to combat encryption viruses. A typical sequence of cyberattacks with information encryption using software tools to implement attacks is determined. The sequence of procedures of the WannaCry encryption part is described. The paper proposes a description of the computational complexity of encrypted data recovery problems, including methods for parallelizing the solution of cryptanalysis problems, methods used to solve problems of cryptosystem stability assessment, vulnerability search and decryption depending on basic mathematical methods. The application of distributed computing technology to solve problems of recovery of encrypted resources is described. The paper states that in modern conditions of constant development of cryptography methods with a high level of stability and their wide availability a necessary condition for improving the recovery of encrypted programs - data seekers is to create a special software security monitor and build specialized multiprocessor systems to implement cryptanalysis methods with wide access of authorized users. , from the point of view of minimizing the ratio "cost - the result" the most rational approach to creating specialized multiprocessor systems is to build a cluster system based on the most powerful general-purpose computers using hardware computing accelerators based on programmable logic integrated circuits to increase the effectiveness of attacks on cryptographic software tools for the implementation of attacks, it is advisable to develop technologies for active actions in cyberspace, in particular, those that provide the formation of hidden channels.
, Yuriy Ryabukha, Pavlo Hurzhii, , Oleh Kulitsa
Cybersecurity: Education, Science, Technique, Volume 3, pp 63-71; doi:10.28925/2663-4023.2020.7.6371

The conceptual basements of constructing an effective encoding method within the bit rate control module of video traffic in the video data processing system at the source level are considered. The essence of using the proposed method in the course of the video stream bit rate controlling disclosed, namely, the principles of constructing the fragment of the frame code representation and approaches for determining the structural units of the individual video frame within which the control is performed. The method focuses on processing the bit representation of the DCT transformants, and at this processing stage transformant was considered as a structural component of the video stream frame at which the encoding is performed. At the same time, to ensure the video traffic bit rate controlling flexibility, decomposition is performed with respect to each of the transformants to the level of the plurality of bit planes. It is argued that the proposed approach is potentially capable to reducing the video stream bit rate in the worst conditions, that is, when component coding is performed. In addition, this principle of video stream fragmen code representation forming allows to control the level of error that can be made in the bit rate control process. However, in conditions where the bit representation of the transformant is encoded, the method is able to provide higher compression rates as a result of the fact that the values of the detection probability of binary series lengths and the values of detected lengths within the bit plane will be greater than in the case of component coding. This is explained by the structural features of the distribution of binary elements within each of the bit planes, which together form the transformer DCT. In particular, high-frequency transformer regions are most often formed by chains of zero elements. The solutions proposed in the development of the encoding method are able to provide sufficient flexibility to control the bit rate of the video stream, as well as the ability to quickly change the bit rate in a wide range of values.
Cybersecurity: Education, Science, Technique, Volume 3, pp 131-152; doi:10.28925/2663-4023.2020.7.131152

The article is devoted to software bitsliced implementation of the Kalyna cipher using vector instructions SSE, AVX, AVX-512 for x86-64 processors. The advantages and disadvantages of different approaches to efficient and secure block cipher software implementation are shown. It is noted that bitslicing technology combines high speed and resistance to time and cache attacks, but its application to the Kalyna cipher is not available at the moment. The basic approaches to data representation and bitsliced encryption operations are considered, special attention is paid to the effective implementation of SubBytes operation, which largely determines the final performance. Existing methods for minimizing logical functions have been shown to either fail to produce the result in bitsliced format in the case of 8-bit non-algebraic SBoxs, or far from optimal. A heuristic algorithm for minimizing logic functions describing Kalyna SBoxes using the operations of AND, OR, XOR, NOT available in the instruction set of low- and high-end processors is proposed. The results show that a bitsliced description of one SBox requires about 520 gates, which is significantly less than other methods. Possible ways to increase performance by regrouping data into bitsliced variables before and after the SubBytes operation are indicated, which results in more efficient use of vector registers. The bitsliced implementations of Kalyna cipher were measured using C++ compilers from Microsoft and GCC for the Intel Xeon Skylake-SP processor. The results of the bitsliced Kalyna implementation can also be transferred to processors that do not support SIMD instructions, including low-end, to increase resistance to attacks through third-party channels. They also enable switching to ASIC or FPGA-based bitsliced implementation of Kalyna.
Hennadii Hulak
Cybersecurity: Education, Science, Technique, Volume 3, pp 153-164; doi:10.28925/2663-4023.2020.7.153164

The components of ensuring the warranty of automated systems, which are subject to increased requirements in connection with their use in many sensitive areas of public activity, including national security and defense, critical industrial technologies, energy and communications, banking, environmental protection , technologies of legitimate distance learning, etc. Certain components can significantly affect the quality and reliability of information services in regulatory conditions. In particular, the special role of the functional security of the cryptographic subsystem in terms of supporting the performance of the automated system for its tasks and functions in general, as well as in terms of ensuring the confidentiality and integrity of information. The components of the cryptographic subsystem have been identified, the poor or incorrect operation of which negatively affects the security of these subsystems. The types of the most dangerous attacks on these subsystems are analyzed, their classification from the point of view of possibility of realization in modern scientific and technical conditions and depending on capacity of available computing means and technologies on the basis of which the most real and dangerous variant of realization of remote attacks on software implementation of cryptographic subsystem is defined. . Based on the analysis, a method for evaluating the quality of cryptographic transformations based on a modified algorithm for solving the problem of finding solutions of systems of linear equations with distorted right-hand parts using the so-called decoding based on "lists" of first-order "shortened" Reed-Muller codes is proved. the correctness of the proposed algorithm.
, Viktoriia Sydorenko, Yuliia Sotnichenko
Cybersecurity: Education, Science, Technique, Volume 1, pp 170-181; doi:10.28925/2663-4023.2020.9.170181

The rapid development of information and communication technologies has increased the vulnerabilities of various networks, systems and objects as well as made it much more difficult to ensure their reliable protection and security. All these factors have led to the fact that the world's leading countries have begun to pay considerable attention to cybersecurity and critical information infrastructure protection. However, the protection of various types of information with restricted access (in particular, confidential information) at critical infrastructure objects remains unexplored. With this in mind, the paper analyzes the existing approaches of the world's leading countries to the confidential information protection at critical infrastructure. The analysis revealed that today there are no comprehensive, multifunctional methods of protecting confidential information at critical information infrastructure. In addition, the classification of critical information infrastructure objects according to information security requirements is developed. This classification by determining the type of processing information, possible access modes and criticality category, allows to ensure unity of approaches to protection of these objects belonging to different types, including information systems, automated control systems and information-telecommunication networks.
, Yuliia Polishchuk, Yuliia Sotnichenko, Dauriya Zhaksigulova
Cybersecurity: Education, Science, Technique, Volume 2, pp 184-196; doi:10.28925/2663-4023.2020.10.184196

According to the large number of cyber incidents that occur every day, the process of critical infrastructure protection is an important not only technical but also scientific task. However, not all states in the world have an opportunity to provide high-quality protection of such infrastructure at a high level. Based on the fact that the critical information infrastructure protection should be managed at the state level, states need to develop a regulatory framework to address the above issue. Considering the legal framework of Ukraine, as in most post-Soviet countries, there is no effective approach to the protection of critical information infrastructure, such as in the USA or in the EU. The legislation of Ukraine identifies only certain objects of the socio-economic sphere, emergencies where they can lead to socially dangerous consequences, while a single procedure for identification and classification of critical infrastructure is not developed. A number of basic terms in the field of critical infrastructure protection from cyber threats, including “critical infrastructure” term, remain normatively vague. The mechanism of organization of activity and interaction of state and private structures in the process of critical infrastructure protection needs scientific substantiation. In this paper, the analysis of the world’s best practices concerning critical information infrastructure protection was carried out, that allows to improve qualitatively, at the state legislative level and practice, process of critical information infrastructure protection of Ukraine.
, Sergii Ilyenko, Diana Kvasha
Cybersecurity: Education, Science, Technique, Volume 1, pp 24-36; doi:10.28925/2663-4023.2020.9.2436

Considering computer-integrated aviation systems that provide a link between civil aviation activities within the ground-to-air and air-to-air channels, the question of the safe operation of such aviation systems from an ever-increasing cyber threats, and the decline in cybersecurity for the aviation industry as a whole. The protection status of ground-to-air and air-to-air channels in such aviation systems is at different levels and depends directly on the activity of all components of aviation activity (airport-aircraft-information network-air traffic management, etc.). To date, some communication channels are not secure at all and are in an open state, which provokes a rapid growth of cyber-attacks and requires the introduction and application of modern information and communication technologies in such communication channels. In view of the ever-increasing cyber statistics on the work of civil aviation worldwide, the authors of the article highlighted the current state of cyber security and protection of ground-to-air and air-to-air channels of the aircraft fleet of Ukrainian airlines, and take a closer look at the world experience. The authors comprehensively covered all components of the aviation system, with particular attention given to aircraft designed by Antonov Design Bureau with the time evolution of tire development and data networks of the world's leading aviation industry leaders (such as Airbus and Boeing). Also, attention is given to the present state and mechanisms of data transmission of the ground-to-air and air-to-air channels and the architecture of the modern air-network of computer-integrated aviation systems. The authors plan a number of scientific and technical solutions for the development and implementation of effective methods and means to ensure the requirements, principles and sub-approaches to ensure cyber security and the organization of protection of ground-to-air and air-to-air channels in experimental computer-integrated aviation systems.
Back to Top Top