Cybersecurity: Education, Science, Technique

Journal Information
EISSN : 2663-4023
Published by: Borys Grinchenko Kyiv University (10.28925)
Total articles ≅ 135
Current Coverage
DOAJ
Filter:

Latest articles in this journal

, Oleksiy Yudin, Viktoriia Sydorenko, Yaroslav Yevchenko
Cybersecurity: Education, Science, Technique, Volume 11, pp 166-182; doi:10.28925/2663-4023.2021.11.166182

Abstract:
Global trends to increase and improve the quality of cyber attacks have led to the actualization of the protection of information and telecommunications systems (ITS), in particular, sectoral, which are critical for the functioning of society, socio-economic development and ensuring the information component of national security. Taking into account the needs of national security and the need to introduce a systematic approach to solving problems of critical infrastructure protection, at the national level, the creation of protection systems for such infrastructure is one of the priorities in reforming the defense and security sector of Ukraine. Thus, there is a need to develop methods and models for classifying ITS as critical infrastructure to ensure the national security of Ukraine. The paper proposes a structural-functional method for determining the functional security profile of the subsystem of the sectoral ITS, which allows to determine the basic functional security profile of the sectoral ITS by determining the sectoral requirements for confidentiality, integrity, accessibility and observability and more fully formulate criteria for assessing the security of information circulating in critical ITS. The study was followed by an experimental study on the example of ITS of the National System of Confidential Communication, which tested the adequacy of the method's response to changes in input data.
, , Maksym Tawalbeh, Andrii Ilkov
Cybersecurity: Education, Science, Technique, Volume 11, pp 183-194; doi:10.28925/2663-4023.2021.11.183194

Abstract:
Anomaly detection is an important task in many areas of human life. Many statistical methods are used to detect anomalies. In this paper, statistical methods of data analysis, such as survival analysis, time series analysis (fractal), classification method (decision trees), cluster analysis, entropy method were chosen to detect anomalies. A description of the selected methods is given. To analyze anomalies, the traffic and attack implementations from an open dataset were taken. More than 3 million packets from the dataset were used to analyze the described methods. The dataset contained legitimate traffic (75%) and attacks (25%). Simulation modeling of the selected statistical methods was performed on the example of network traffic implementations of telecommunication networks of different protocols. To implement the simulation, programs were written in the Pyton programming language. DDoS attacks, UDP-flood, TCP SYN, ARP attacks and HTTP-flood were chosen as anomalies. A comparative analysis of the performance of these methods to detect anomalies (attacks) on such parameters as the probability of anomaly detection, the probability of false positive detection, the running time of each method to detect the anomaly was carried out. Experimental results showed the performance of each method. The decision tree method is the best in terms of anomaly identification probability, fewer false positives, and anomaly detection time. The entropy analysis method is slightly slower and gives slightly more false positives. Next is the cluster analysis method, which is slightly worse at detecting anomalies. Then the fractal analysis method showed a lower probability of detecting anomalies, a higher probability of false positives and a longer running time. The worst was the survival analysis method.
Roman Korolkov
Cybersecurity: Education, Science, Technique, Volume 3, pp 144-154; doi:10.28925/2663-4023.2021.11.144154

Abstract:
One of the most serious security threats to wireless local area networks (WLANs) in recent years is rogue access points that intruders use to spy on and attack. Due to the open nature of the wireless transmission medium, an attacker can easily detect the MAC addresses of other devices, commonly used as unique identifiers for all nodes in the network, and implement a spoofing attack, creating a rogue access point, the so-called "Evil Twin". The attacker goal is to connect legitimate users to a rogue access point and gain access to confidential information. This article discusses the concept, demonstrates the practical implementation and analysis of the “Evil Twin” attack. The algorithm of the intruder's actions, the scenario of attack on the client, and also procedure for setting up the program-implemented rogue access point is shown. It has been proven that the implementation of the attack is possible due to the existence of several access points with the same service set identifier and MAC address in the same area, allowed by 802.11 standard. The reasons for failure operation of the network and possible interception of information as a result of the attack are identified, methods of detecting rogue access points are analyzed. During the experiment, observations of the 802.11 frames showed that there were deviations in the behavior of beacon frames at the time of the "Evil Twin" attack. First, the number of beacon frames coming from the access point which succumbed to the attack is increasing. Secondly, the traffic analyzer detected significant fluctuations in the values of the received signal level, which simultaneously come from a legitimate and rogue access point, which allows to distinguish two groups of beacon frames. The "Evil Twin" attack was implemented and researched using Aircrack-ng – a package of software for auditing wireless networks, and Wireshark – network traffic analyzer. In the future, the results obtained can be used to improve methods of protection against intrusion into wireless networks, in order to develop effective systems for detecting and preventing intrusions into WLAN.
, Oleksiy Yudin, Viktoriia Sydorenko, Yaroslav Yevchenko
Cybersecurity: Education, Science, Technique, Volume 3, pp 167-183; doi:10.28925/2663-4023.2021.11.167183

Abstract:
Global trends to increase and improve the quality of cyber attacks have led to the actualization of the protection of information and telecommunications systems (ITS), in particular, sectoral, which are critical for the functioning of society, socio-economic development and ensuring the information component of national security. Taking into account the needs of national security and the need to introduce a systematic approach to solving problems of critical infrastructure protection, at the national level, the creation of protection systems for such infrastructure is one of the priorities in reforming the defense and security sector of Ukraine. Thus, there is a need to develop methods and models for classifying ITS as critical infrastructure to ensure the national security of Ukraine. The paper proposes a structural-functional method for determining the functional security profile of the subsystem of the sectoral ITS, which allows to determine the basic functional security profile of the sectoral ITS by determining the sectoral requirements for confidentiality, integrity, accessibility and observability and more fully formulate criteria for assessing the security of information circulating in critical ITS. The study was followed by an experimental study on the example of ITS of the National System of Confidential Communication, which tested the adequacy of the method's response to changes in input data.
, Berik Akhmetov, Borys Husiev, Andrii Blozva, , Tetiana Osypova
Cybersecurity: Education, Science, Technique, Volume 3, pp 6-15; doi:10.28925/2663-4023.2021.11.615

Abstract:
It is shown that the application of multi-step quality games theory allows financing of various information technologies considering various factors. In particular, there are lots of approaches to building effective information security systems in the enterprise. Using such model will make it possible to develop, based on game models, decision support systems (DSS), for example, software products (PP). Which, in turn, will allow making rational decisions on investing in the development of such technologies. This circumstance makes it necessary and relevant to develop new models and software products that can implement decision support procedures in the process of finding rational investment strategies, including in information security field of enterprises, and obtaining forecast assessment for feasibility of a specific strategy. The model proposed by us is based on analysis of financing process by investors in information technology for protecting information tasks for the case of their multi-factoring in fuzzy setting. The investment process management model is proposed, using the example of investing in the information security of informatization objects taking into account multi-factoring and in fuzzy setting for DSS computational core. The difference between the model and previously developed ones is that it considers the investment process as complex structure, for which it is not enough to model it as a single-factor category. Computational experiments were performed for the developed model. The simulation results are visualized in the Python programming language, which allows you to optimize the procedures for investment process managing.
, , Hanna Nazarkevych
Cybersecurity: Education, Science, Technique, Volume 3, pp 16-30; doi:10.28925/2663-4023.2021.11.1630

Abstract:
Biometric images were processed and filtered by a newly developed Ateb-Gabor wavelet filter. Identification of biometric images was performed by machine learning methods. The Gabor filter based on Ateb functions is effective for filtering because it contains generalizations of trigonometric functions. Developed wavelet transform of Ateb-Gabor function. It is shown that the function depends on seven parameters, each of which makes significant changes in the results of filtering biometric images. A study of the wavelet Ateb-Gabor function was performed. The graphical dependences of the Gabor filter wavelet and the Ateb-Gabor filter wavelet are constructed. The introduction of wavelet transforms reduces the complexity of Ateb-Gabor filter calculations by simplifying function calculations and reducing filtering time. The complexity of the algorithms for calculating the Gabor filter wavelet and the Ateb-Gabor filter wavelet is evaluated. Ateb-Gabor filtering allows you to change the intensity of the entire image, and to change certain ranges, and thus change certain areas of the image. It is this property that biometric images should have, in which the minions should be contrasting and clear. Ateb functions have the ability to change two rational parameters, which, in turn, will allow more flexible control of filtering. The properties of the Ateb function are investigated, as well as the possibility of changing the amplitude of the function, the oscillation frequency to the numerical values ​​of the Ateb-Gabor filter. By using the parameters of the Ateb function, you can get a much wider range of shapes and sizes, which expands the number of possible filtering options. You can also implement once filtering, taking into account the direction of the minutes and reliably determine the sharpness of the edges, rather than filtering batocrates. The reliability results were tested on the basis of NIST Special Database 302, and good filtration results were shown. This was confirmed by a comparison experiment between the Wavelet-Gabor filtering and the Ateb-Gabor wavelet function based on the measurement of the PSNR signal-to-noise ratio.
, Tetiana Tereshchenko, Iryna Buchynska, Viktoriia Klepatska
Cybersecurity: Education, Science, Technique, Volume 3, pp 110-123; doi:10.28925/2663-4023.2021.11.110123

Abstract:
The article discusses the issues of increasing the efficiency of the classification process of cards of electronic control units of a car engine. The analysis of the existing software for editing calibration tables in electronic engine control unit, which has tools for determining calibrations and data recognition, was carried out. The limits of use of such software products are conditioned by a small number of specified classes of calibration tables and low data processing speed. The analysis of testing results of classification methods using spectral decomposition demonstrated that a system based on this method requires complex transformations of the results of spectral decomposition. The use of spectral decomposition as a solution of the classification problem is possible if some characteristics of the input data are determined and used as data for classification. It was developed a data classification algorithm that uses characterizers to compute a clearly identified characteristic of the input matrix. The software package for the implementation of the developed algorithm was carried out by using the .NET Framework and the C # programming language. The testing of the classification system performance performed by using the developed software system on a small sample of maps. The results of preliminary testing showed that the system determines correctly the class of the provided card after training. Further testing on the Mercedes-Benz Bosch EDC16C31 / EDC16CP31 car block family showed that in cases of a large number of training images, the result meets the requirements. The performed tests allowed us to determine the optimal number of images for training and the time required for this.
, Sergii Ilyenko, Danylo Stashevskyi
Cybersecurity: Education, Science, Technique, Volume 3, pp 61-72; doi:10.28925/2663-4023.2021.11.6172

Abstract:
This article is devoted to the consideration of further relevant ways to ensure the procedure of error tracking in high-load web applications implemented in the Javascript programming language. The article investigates and identifies that errors that occur when developing and using modern high-load web applications are very dangerous because they affect the full functioning of the information system as a whole and can lead to breaches of confidentiality and integrity of personal information. In the article the authors consider the issues of error handling in Javascript programming language, the problem and need to track errors in high-load web applications, the concept of high-load web applications, existing methods and approaches to error tracking, principles of modern high-load web applications and comparison of existing error tracking solutions. in high-load web applications implemented in the Javascript programming language. The result of this research was the creation of an author's software module for error tracking in advanced web applications to solve the problem of logging errors, analysis of logs for completeness, error handling and solving them in the future. Also, the implementation of such a solution allows you to reduce the size of the software application to download up to 5 kilobytes and save the error history. The developed software module for error tracking in highly loaded web applications consists of two parts: client and server. Each part is an independent software module and can be reconfigured with minimal configuration changes on any other resource. This implementation allows you to fully collect metrics for each XMLHTTP request, collect information about the user environment in which the error occurred, collect information about what exactly caused the error, determine the specific location where the error occurred while executing program code, using a custom algorithm , save error stories in Kibana log. Possible areas of development of this work are related to the expansion of the error tracking algorithm, to collect more data and improve their aggregation, based on the expansion of metrics. The authors plan a number of scientific and technical solutions to develop and implement effective methods, tools, requirements, principles and approaches to cyber security and protection based on the use of author's approaches to error tracking in high-load web applications in experimental computer systems and networks.
Mykyta Moshenchenko, Bohdan Zhurakovskyi
Cybersecurity: Education, Science, Technique, Volume 3, pp 100-109; doi:10.28925/2663-4023.2021.11.100109

Abstract:
This article discusses the problems of information security in "SmartCity" systems. The comparison of existing solutions and data protocols for wired solutions, such as IPsec, SSL, TLS and wireless systems: ZigBee, Z-Wave, Thread, WeMo. The advantages and disadvantages of each of the existing systems are analyzed. The SmartCity system must be able to recognize a specific situation that arises in the house, city, workplace, when processing large amounts of data, to respond accordingly: one of the systems can control the behavior of other systems using a pre-designed algorithm. The main purpose of the "SmartCity" system is to save energy, which is becoming increasingly important due to their rise in price in Ukraine. Therefore, intellectualization is becoming increasingly popular, catching up with global trends in home automation. However, despite the development and gradual formal and informal standardization of smart city technologies, and any home automation, there is still the problem of choosing protocols for the transfer of information between controlled devices, sensors and other elements. This problem is especially serious when it is necessary to ensure the confidentiality and integrity of data circulating in the system. The purpose of this study is to find a secure network protocol that allows you to use it in automatic signaling equipment, so you can not use special software and hardware solutions to affect the confidentiality and integrity of information.In the article is not the last issue of information security such a house of the city government system or production, can cause very great damage to its owner. As remote management and access to information are quite common nowadays, secure schemes, encryption and protection schemes should be used to reduce the percentage of vulnerabilities and prevent intruders from causing harm.
Roman Chernenko, Olena Riabchun, Maksym Vorokhob, , Valerii Kozachok
Cybersecurity: Education, Science, Technique, Volume 3, pp 124-135; doi:10.28925/2663-4023.2021.11.124135

Abstract:
Because IoT devices work with data that may be confidential or confidential, that data must be protected. Due to the peculiarities of platforms and the implementation of such systems, namely: first, the use of devices with limited computing characteristics, which makes it impossible to use traditional means of information protection and data transmission protocols, and secondly. systems, and provide them with sufficient computing resources due to the impossibility of laying power lines, thirdly, the lack of standards for the implementation of these devices in the existing infrastructure, there are serious threats to the confidentiality, integrity and availability of information. The article considers the model of the IoT system, oneM2M standard presented by the European Institute of Communication Standards. IoT devices are designed with the necessary network connectivity, but often do not provide reliable network security. Network security is a critical factor in the deployment of IoT devices. The situation is complicated by the fact that IoT largely consists of limited devices. A limited device usually has a very limited cycle of power, memory, and processing. IoT devices are particularly vulnerable to threats because many of the current IoT devices do not support encryption. Several known encryption algorithms were selected for analysis: RSA, Vernam cipher, El Gamal scheme. After analyzing the above algorithms, a prototype of the IoT system was developed using limited devices, which provides absolute cryptographic stability. The prototype consists of a gateway in the role of a Raspberry pi 3 B + microcomputer, a limited Arduino Nano device with a connected sensor and a software implementation of the above-mentioned Vernam cipher with all the tasks.
Back to Top Top