CONTROL AND MANAGEMENT OF DISTRIBUTED INTRUSION DETECTION SYSTEMS USING LOGS IN ADVERSE CONDITIONS

This paper proposes an asynchronous system of control and management of the log verification and audit system, which is based on asynchronous procedures for sending "receipts" (push/pull) by nodes of different levels of the network infrastructure and maintains operability in conditions of partial loss of functionality of the network infrastructure. The problems of management and control of distributed intrusion detection systems (SIEM) in adverse conditions (blackouts, cyberattacks, etc.) are considered. Shown the role of SIEM in reducing the time interval between intrusion into a system and its malware infection and detection of the fact of intrusion. The problems of existing SIEMs are listed, the classification of intrusion detection methodologies is given, and the essential role played by system logs (logs) in detecting and eliminating cyber threats is indicated. The work describes various possibilities of control and verification of system logs: a system based on linked lists, systems based on hash trees (Merkle Tree and Verkle Tree). The task of creating a system that is insensitive to full or partial temporary disruption of the connectivity of the network infrastructure, which may occur as a result of adverse influences, is set. The deployment of proposed system, on the one hand, allows preserving and maintaining integrity of logs under conditions of adverse effects, on the other hand, due to asynchrony, it allows you to evenly distribute the load within the network infrastructure without overloading the information audit nodes with a large amount of calculations. The implementation and deployment of the system based on the proposed principles requires fewer resources compared to existing SIEM systems and can be implemented both independently and with integration into an already deployed SIEM, if any. The proposed measures will make it possible to significantly increase security, prompt response to incidents, and the ability to restore existing information networks.