Study of information security breach and intruder identity has a great scientific and practical importance. From this viewpoint parameters formalization for intrude identification is an actual research problem. Clearly definition of complete set parameters can give a possibility to increase preventive measures and security systems efficiency. In the paper etalon model of linguistic variables was proposed and oriented on IDS system construction. For intruder detection the set of host and network parameters are used. Most of them have a fuzzy nature. The etalon models were build using fuzzy numbers on basis of experiment. Given results can be the basis for IDS system based on honeypot-technology development.
Studying of the person of information security intruder has a great scientific and practical importance. In addition accordingly to normative documents intruders and threats models development is important stage in development of effective information security systems. From this viewpoint parameters formalization for intruder identification is an actual research problem. The solving of this problem is a subject of the paper. Definition of complete set (cortege) of host and network parameters can give a possibility to consider features of attacks (from people or robots) and to increase preventive measures & security systems efficiency. Given results can be the basis for intrusion detection systems based on honeypot-technology development.
The providing of state information resources security is inextricably connected with information security intruder's activity in information & communication systems where restricted data is circulating. The modern intruder detection systems, based on heuristic principle of information security violation detection, have a disadvantage because these are basically oriented on mathematical models which require much time to prepare statistic data. Mathematical models based on expert approach are more effective in this way. The method proposed in paper allows to solve the problem of intruder detection and identifying in information & communication systems and networks, which are weakly-formalized fuzzy environment. In the method elements of fuzzy logic are used to the previous decision of the violation & the intruder identification and precise basis of conventional logic that provides clarifying identification. The method consists of such stages: selection of the method for determining the importance of factors, the formation of categories sets of intruder and parameters, forming standards of fuzzy parameters, forming the set of heuristic rules, forming connections of intruder category with parameters, phasing of fuzzy parameters and definition clear parameters, processing and forming of parameters corteges, results formation. The method's work is organized in three phases: preparation, work with fuzzy parameters and work with clear parameters. On the basis of this method can be synthesized heuristic type intruder detection & identification system with high performance in fuzzy terms by the use of expert methods.
Efficient detection of information security intruder in information and communication networks and systems is a complex task that requires the use of special security means – intruder detection systems. Most of these systems are based on the use of signature methods and have several disadvantages, including the demands on resources and costs of various kinds (e.g., sampling statistics, systems studying, their adaptation and others). Expert approaches based on the use of knowledge and experience of specialists in some sector are more effective in this viewpoint. The paper presents a structural solution of intruder detection and identification system based on fuzzy logic. The system consists of preprocessing subsystem for clear and fuzzy parameters forming, fuzzy standards and heuristic rules forming (according to fuzzy and clear controlled parameters) and modules of cortege forming, linguistic output and visualization that can detect and identify the intruder. The result of the system work is represented in linguistic and graphical forms
Most of existed intruder detection systems based on heuristic principle of information security violation detection and oriented on using mathematical models which need a lot time for statistical data preparation. Mathematical models based on expert approach are more effective but they need adequate rules for decision making. For this problem solving in die paper the model of heuristic rules based on fuzzy logic was proposed. This model uses plurals "intruder influence - parameter", "intruder influence — set of logical & linguistic connection" and universal model of parameter etalons and allows to display in information system some anomaly generated by influence of some category intruder. On the basis of this model were developed the examples of rules for detection the activity of such categories of intruders as misinformer, hacker, cracker, spammer, bot-braker and spamm-bot. These can be used in practice for the perfection of real intruder detection systems in information systems.
In the paper the review of intrusion detection systems based on honeypot technology was carried out. The comparative description of the generation methods for signatures of intrusion detection systems based on virtual honeypot also was given. These results will be useful for development of new and improvement of existed intrusion detection systems.
In the article the analysis of existed virtual decoy systems based on honeypot technology was carried out. The analysis showed the evolution of honeypot systems from Low-Interaction Honeypots to modern Gen III Honeynets and pointed to the disadvantages of existed solutions. In addition the classification of honeypot systems by the feature principle was fulfilled. Later these results can be used to develop honeypot systems for efficiency increasing of information security incident management systems.
