Ensuring data integrity is a fundamental requirement for investigating computer crimes in industrial networks. In such complex and distributed environments, data generated by sensors and collected by controllers is a critical asset that determines the correctness of processes, the safety of personnel and the economic efficiency of production. Any unauthorized access, modification, or destruction of this data can lead to serious consequences, from equipment downtime to emergencies and significant financial losses. Traditional protection mechanisms based on centralized servers and databases create a single point of failure and vulnerabilities that attackers can exploit. In this area, blockchain technology offers a new approach based on decentralization, cryptographic security and immutability of records, which allows us to solve three key tasks: protection against unauthorized modification, ensuring full traceability of events and increasing the overall resilience of the system to failures.

This paper presents an adaptive mechanism-an integral component of a digital twin-based method for detecting information security threats in critical information infrastructure (CII) assets. The mechanism enables automated maintenance of machine learning model effectiveness through a three-tiered adjustment strategy: operational fine-tuning on new data, tactical hyperparameter optimization, and strategic threat scenario updates within the digital twin. The mechanism implements a closed-loop cycle of “monitoring → analysis → adaptation → deployment,” eliminating the need for direct intervention in the real asset’s technological processes. Experimental validation on synthetic data emulating telemetry from an energy facility confirmed the mechanism’s feasibility: all three modes significantly outperformed the baseline model in terms of the F2-score, with each mode proving optimal for its specific task-from rapid real-time correction to proactive updates in response to novel adversary tactics. The proposed mechanism enables practical implementation of a self-learning defense system capable of sustaining a high level of security amid an evolving threat landscape.

The paper evaluates the effectiveness of an adaptive threat detection approach based on model fine-tuning using synthetic data generated by a digital twin of a power system. Three strategies were compared: a static model, finetuning on real-world operational data, and fine-tuning on synthetic data from the digital twin. The analysis was performed on multivariate time series of telemetry reflecting normal operating conditions and simulating three types of cyberattacks: false data injection, load redistribution, and their combination. Telemetry data were generated as multivariate time series featuring a base oscillatory component, additive autoregressivetype noise, and time-varying variance, cyberattacks were modeled as deviations of predefined shape and amplitude. The static model proved ineffective in detecting novel threats. Finetuning on real data achieved high precision but insufficient recall. The best trade-off was obtained with the digital twin approach, yielding higher detection recall at an acceptable false positive rate. This method enables safe adaptation of detection mechanisms without disrupting the operation of the power system.

Energy infrastructure is critical to a nation's security and economy. This also makes it a top target for sophisticated cyber attacks. The development and validation of modern defense methods for power systems face a number of fundamental challenges. The technology of the digital twin is increasingly considered as a tool to overcome these limitations. The paper focuses on the development of a digital twin platform for modeling and analyzing cyber threats in industrial control systems of power grids. The platform integrates modules for system configuration, process simulation, synthetic data generation, and risk assessment. The study proposes an approach for adaptive anomaly detection using synthetic data generated by the digital twin. Experimental results demonstrate the advantage of this approach compared to traditional security model adaptation methods. The platform enables safe testing of defense mechanisms and addresses the lack of real-world cyber attack data. Directions for further platform development are outlined, including integration with industrial equipment and the expansion of threat modeling capabilities.

Modern Critical Information Infrastructure (CII) facilities represent complex cyber-physical systems that are vulnerable to targeted cyberattacks capable of causing cascading failures. Traditional information security threat modeling approaches, based on component-oriented analysis, prove insufficient for risk assessment in such systems due to their failure to account for the interconnections between heterogeneous aspects of their operation. This article proposes an approach to creating a Digital Twin (DT) for information security threat modeling, based on the preliminary decomposition of the CII object. The decomposition is performed across five facets: technical, procedural, organizational, functional, and sectoral, with subsequent detailing of each facet in the domains of states and functions. The resulting structured description serves as the basis for forming a logical DT model, whose components unambiguously correspond to the identified aspects of the CII. The main results of the work include: a formalized approach to the decomposition of CII objects, a logical DT model for threat analysis, a definition of the DT's functions within the modeling process, and a description of the DT's integration into threat modeling stages. It is demonstrated that the proposed approach enables the simulation of attacks, consequence forecasting, defense adaptation, and verification of the effectiveness of protective measures in an isolated environment, thereby minimizing the impact on the actual infrastructure.

The paper discusses an approach to protecting image recognition systems from adversarial attacks such as FGSM (Fast Gradient Sign Method), based on a combination of various security methods. The FGSM attack is one of the most common adversarial attacks. It is based on adding subtle perturbations to the input data to deceive the machine learning model and cause errors in the image recognition process. To improve recognition accuracy in the face of FGSM attacks, the following security methods are considered: noise reduction, compression, and neural image cleaning. Combining security methods involves finding the optimal parameters that characterize these methods, at which the recognition accuracy becomes maximum. The effectiveness of the security methods under consideration is evaluated using the CIFAR-10 dataset. The choice of this dataset due to its wide application in image classification problems. The experimental results show that combining these security methods allows achieving maximum accuracy of image recognition in the face of FGSM attacks. The results obtained can be useful for developing more reliable computer vision systems that can withstand modern threats in the field of machine learning. The proposed approach demonstrates the promise of using hybrid security strategies to ensure the security of AI systems in real-world applications.

Protecting the Industrial Internet of Things against computer attacks is currently becoming an important issue. Using wavelet analysis to detect malicious intrusions into a computer network, which may be caused by computer attacks, is a rather interesting approach to solving this problem. This approach allows one to quickly detect abnormal changes in network traffic caused by security threats. The paper considers a network intrusion detection technique based on using methods of wavelet and statistical analysis. Models are proposed for statistical evaluation of wavelets selected for detecting network intrusions, for which the most preferable wavelet is selected by testing statistical hypotheses about the equality of average values, variances, and distribution laws in the reference and noisy (intrusion-prone) network traffic samples. The technique for detecting network computer attacks is based on analyzing the energy spectrum of the signal, reconstructed from the coefficients of the wavelet decomposition using the most preferable wavelet. The sensitivity of network intrusion detection to the frequency range of the reconstructed signal is estimated. Evaluation of the proposed approach based on the results of the experiments confirms its efficiency.

The paper presents a formalized model for describing information security (IS) threats in relation to critical information infrastructure (CII) objects. The model is based on the decomposition of CII objects into five interrelated attributes: technical, process, organizational, functional, and sectoral. Each CII component is described in the context of these attributes, which enables more accurate identification of vulnerabilities and potential threats. A key element of the work is the introduction of the concept of interconnections between attributes, allowing the complex nature of CII and its interdependencies to be considered in risk assessment. For practical implementation of the model, a specialized database of IS threats was developed. It supports classification, filtering, and analytical processing of threats, with the capability to map them to the Information Security Threats Classifier by Federal Service for Technical and Export Control (FSTEC of Russia). The implementation of the database enables the use of the proposed approach in applied information security tasks. The proposed model and database provide a theoretical and practical foundation for systematic IS threat analysis, improving the security of CII objects and enhancing risk management methods in this domain

Adversarial attacks are now becoming quite a dangerous means of disrupting image processing systems that use machine learning methods for decision making. Therefore, developing effective countermeasures against adversarial attacks is becoming quite an important area of cybersecurity. The paper proposes a noise-based approach to countering adversarial attacks that is augmented with neural-cleanse and jpeg-compression technologies. The idea of the proposed approach is that adding noise distorts the effect of an adversarial attack, and neural cleaning and jpeg compression eliminate the consequences of such an effect. The paper examines the three most well-known types of adversarial attacks: Fast Gradient Sign Method, Zeroth Order Optimization and One Pixel Attack. These attacks manipulate input data, resulting in misclassification or incorrect predictions by exploiting high-frequency components that are undetectable to humans. The research was carried out on two datasets: MNIST-JPG and PC Parts Images. Two types of noise were used: Gaussian and Poisson. During the experiments, optimal parameters for these types of noise were found, ensuring maximum accuracy of image recognition after exposure to adversarial attacks.

The paper examines the issue of managing the information security system by selecting and forming an optimal set of means of protecting the information technology object. To solve this problem, it is proposed to use game theory algorithms, the payment matrices of which are reduced to modeling conflict situations and choosing optimal strategies based on the Bayes, Wald, Hurwitz and Laplace criteria. An example of applying these criteria to select strategies is given. The example is based on the results of analyzing statistical material on current cyber threats and the probabilities of their reflection by various means of protecting the information technology object. Experimental evaluation has shown that the proposed approach allows for ensuring the required level of information security.

Системы на основе машинного обучения в настоящее время являются привлекательными мишенями для злоумышленников, поскольку нарушение работы таких систем может иметь серьезные последствия для объектов критической инфраструктуры, в частности, энергетических систем. В связи с этим количество различных типов кибератак на системы машинного обучения, которые называются состязательными атаками, постоянно растёт, и эти атаки являются предметом изучения многих исследователей. Соответственно, ежегодно появляется множество публикаций, посвящённых обзорам состязательных атак и методов защиты от них. Многие виды состязательных атак и методы защиты в этих обзорных статьях пересекаются. Однако в более поздних исследованиях содержится информация о новых типах атак и методах защиты. Цель данной статьи – проанализировать исследования, проведённые за последние шесть лет и опубликованные в высокорейтинговых журналах, с акцентом на обзорные работы. Результатом исследования является уточнённая классификация состязательных атак, характеристика наиболее распространённых атак, а также уточнённая классификация и характеристика методов защиты от этих атак. Основное внимание в анализе уделяется состязательным атакам, нацеленным на энергетические системы. В заключительной части статьи рассматриваются преимущества и недостатки различных методов противодействия состязательным атакам.

Anomalies in the work of data center users can be caused by both Structured Query Language (SQL) injection attacks and user attempts to make unauthorized access to data. The paper explores various machine learning models to detect such anomalies. The peculiarity of the problem being solved is its focus on the university data centers, whose databases have a non-normalized structure. In this case, the problem of reducing the feature space arises. The paper proposes an algorithm for generating a dataset based on typing the data table names. The experimental results obtained on supervised, unsupervised and semi-supervised machine learning models confirmed the high efficiency of the proposed approach. They showed that the support vector machine, random forest, Gaussian Naive Bayes, and neural network models are the most effective in detecting known SQL injections, and the local outlier factor semi-supervised learning model is the most effective in detecting unknown SQL injections and unauthorized access attempts.

Disruption of the normal functioning of distributed computing systems due to computer attacks, the impact of malicious software and other methods of implementing unauthorized access to the information processed in them can lead to significant damage, sometimes not measurable in monetary terms. The problem of information protection in distributed computing systems related to critical infrastructure objects is especially relevant. Achieving the required level of information protection necessitates assessing the security of information in distributed computing systems at all stages of the life cycle. The paper presents an approach to quantitative assessment of the level of protection from computer attacks in in distributed computing systems, which ensures increased efficiency of security management by using a complex indicator that takes into account both the characteristics of the security breach process and the characteristics of the security process, as well as the use of a security graph that takes into account the real structure of in distributed computing system.

Machine learning-based systems, or machine learning systems, are currently attractive targets for attackers, since disruption of such systems can cause crucial consequences for critical infrastructure, in particular, energy systems. Therefore, the number of different types of cyber attacks against machine learning systems, which are called adversarial attacks, is continuously increasing, and these attacks are the subject of study for many researchers. Accordingly, many publications devoted to reviews of adversarial attacks and defense methods against them appear every year. Many types of adversarial attacks and defense methods in these review articles overlap. However, more recent studies contain information about new types of attacks and defense methods. The purpose of this article is to analyze the research conducted over the past six years in highly ranked journals, with an emphasis on review papers. The result of the study is a refined classification of adversarial attacks, characteristics of the most common attacks, as well as a refined classification and characteristics of defense methods against these attacks. The analysis focuses on adversarial attacks that target energy systems. The article concludes with a discussion of the advantages and disadvantages of various adversarial defense methods.

In the digital industry, the most promising and effective way to organize a distributed data storage is to use the distributed file system HDFS. The paper proposes an approach to ensuring the reliability and efficiency of distributed storage, which is based on optimizing the file distribution plan in the data storage, taking into account the criteria of reliability and operational efficiency. The proposed approach allows to reduce the response time of the storage system to requests. This is achieved in such a way that the indicator of operational efficiency tends to the maximum, and the reliability indicator is subject to restrictions corresponding to the requirements. The proposed approach consists of four stages: preparation of initial data, formation of preferred file distribution plans at the stages of design and reconfiguration of the storage, search for the optimal file distribution plan, distribution (redistribution) of files among storage nodes in accordance with the optimal distribution plan. Experimental evaluation of the proposed approach confirmed its high efficiency.

The purpose of the study: development and evaluation of a method for countering FGSM, ZOO, OPA adversarial attacks on image classification systems based on the integration of noise pollution, neural cleansing and JPEG data compression. Research methods: system analysis, machine learning, image noising, neural cleansing, JPEG data compression, computational experiment. Results obtained: an analysis of works on the topic of attacks on image classification systems (ICS) based on the application of machine learning methods, and methods of protection against them was carried out. Based on the results of this analysis, it was revealed that the most common attacks on ICS include adversarial attacks, namely: Fast Gradient Sign Method (FGSM), Zero-Order Optimization (ZOO) and One Pixel Attack (OPA). The topic of countering these attacks is currently of great interest. The essence of the impact of these attacks on ICS is disclosed, and their influence on the accuracy of ima ge recognition is revealed. A method for countering adversarial attacks is proposed, based on image noising with Gaussian and Poisson noise, as well as the use of JPEG compression and neural cleansing technology. Experiments were conducted showing the high efficiency of the proposed method. The experiments were aimed at assessing the accuracy of image re cognition contained in two different data sets - a set of images of personal computer parts and a set of handwritten digital images. The results of image recognition were evaluated before and after exposure of the ICS to adversarial attacks, as well as after applying the proposed method to these sets. Scientific novelty: an analysis of works on the topic of protection against adversarial attacks showed that currently the most typical attacks on ICS are FGSM, ZOO and OPA attacks. The proposed method for countering adversarial attacks on ICS differs from other known protection methods in that it integrates the capabilities of countering attacks contained in three different approaches (neural cleansing, noise pollution and JPEG compression) and identifies the optimal para meters of these approaches. The high efficiency of the proposed method was confirmed in experiments conducted on two different data sets. Contribution: Igor Kotenko and Igor Saenko – general concept of adversarial attacks on ICS and methods of protection against them based on well-known works; Igor Kotenko and Oleg Lauta – description of methods of impact of adversarial attacks; Nikita Vasilev and Vladimir Sadovnikov – implementation of the proposed approach; Igor Kotenko and Igor Saenko – theoretical justification of the proposed approach.

Currently, wavelet analysis is becoming increasingly widespread as a promising means of detecting hidden information, encoded messages or changes in signals that may be associated with a security threat. Therefore, the possibility of using wavelet analysis to detect intrusions into computer systems and analyze network traffic is of considerable interest. This area has not yet been sufficiently explored since the effectiveness of attack detection by wavelet analysis is largely determined by the correct choice of the base wavelet, and the choice of the wavelet most suitable for analyzing specific data is more of an art than a mathematically based operation. To overcome this uncertainty, the paper proposes an approach to the evaluation and selection of wavelets for detecting computer attacks, which is based on the use of mathematical statistics methods. According to the proposed approach, the estimated wavelets are studied on the reference and noisy signals. The noise models the changes caused by the attack. Arrays of wavelet coefficients obtained from wavelet mapping of reference and noisy signals are subjected to statistical processing. It comes down to testing hypotheses about the equality of means, equality of variances, compliance of samples with a normal distribution and differences in the laws of sample distribution. The wavelet that allows the largest number of null hypotheses to be true is selected. The proposed approach was applied to Daubechies, Haar and Mexican Hat wavelets. The evaluation results showed that Mexican Hat is the most preferred wavelet for detecting computer attacks.

Currently, cybersecurity issues for critical infrastructures are complicated by the need to process large amounts of data on security events. This leads to the need to develop an information technology that combines analytical processing of big data on security events with supercomputing. The paper discusses the main provisions of such technology. The general scheme of the developed technology and the architecture of the system realizing it are proposed. The paper presents a high-level and low-level description of the system architecture. Experimental results of evaluation of the developed technology obtained at the supercomputer center “Polytechnik” are presented. These results confirmed the effectiveness of the proposed information technology and demonstrated its high performance.

Recently, different deep learning based techniques have been proposed to detect intrusions and anomalies in the information systems. Convolutional neural networks are often used to reveal hidden spatial relations between features, however their application requires certain data preprocessing techniques that transform tabular non-spatial data to matrices. This paper studies different approaches to tabular data transformation to images and analyzes their impact on the efficiency of attack detection including the ability to detect novel and unseen attacks. Experiments are conducted using the CICIDS2017 dataset, which describes network traffic flows as numerical vectors and contains different types of attacks. The conducted research allowed us to conclude on areas of applicability of tabular data transformation to images considering advantages and limitations of such preprocessing.

Nowadays, machine learning is becoming an increasingly widely used artificial intelligence technology and is being actively implemented in various fields of science and technology, such as defense against cyber attacks, image recognition, computer vision, autonomous vehicles and other complex tasks. However, despite the benefits of machine learning, it attracts the attention of attackers. Cyberattacks against machine learning models, such as classifiers or artificial neural networks, can seriously distort the results of these models and cause irreversible damage to machine learning-based decision-making systems. Therefore, research aimed at countering cyber attacks using machine learning models is becoming very important nowadays. The paper presents a method for protecting against adversarial attacks, Zeroth Order Optimization (ZOO), which is based on the use of Neural-Cleanse technology and the addition of Gaussian and Poisson noise. The proposed approach is aimed at increasing the resistance of neural networks to malicious attacks by additional processing of input data and complicating the optimization problem for attackers. An experimental evaluation of the proposed approach was carried out on the PC Parts Images Dataset using the K-Nearest Neighbors, Random Forest, Naive Bayes Classifier, and Decision Trees classifiers. The study results showed the high efficiency of the proposed approach to protecting models from the effects of adversarial ZOO attacks. The findings may be useful for developing more reliable systems and improving security in the field of machine learning.