Method and Algorithm for Vulnerability Detection in the Protocols of Critical Information Infrastructure Objects

Problem statement. Due to the constant emergence of new threats and vulnerabilities, significant efforts of IS specialists are devoted to the development of methods and algorithms for finding vulnerabilities in telecommunication protocols, software, and information systems. Thus, the actual task is to automate the process of vulnerability search, to develop automatic and automated methods that reduce the routine functions of the IS specialist associated with the search for vulnerabilities. The aim of the work is to increase the efficiency of vulnerability search in TCP/IP stack protocols for critical information infrastructure. Methods used: methods of systems theory, probability theory, stochastic search methods based on Markov chains, genetic algorithms, methods and algorithms of testing and testing technologies, and search for vulnerabilities in software that processes protocol constructs of TCP/IP stack for critical information infrastructure. Novelty: a method, algorithm and software tool for searching for vulnerabilities in protocols, allowing to form test constructs based on stochastic random search for vulnerabilities, have been developed. The proposed solution allows to purposefully form test constructs in a given state space of protocols, obtain test sequences based on Markov chains, and modify them with genetic algorithms. Result: The application of the proposed method and algorithms of vulnerability search allows to investigate a given state space of protocols functioning in CII and allows to reduce the time of formation of test designs in comparison with the method of complete enumeration. Due to the peculiarities of the developed algorithm, the solution for the search for vulnerabilities based on the violation of the structure of the incoming traffic to the processing system, and not only the supply of an unintended type of information, is realized. Theoretical significance: contribution to the theory of information security in the field of improving methods of testing protocol designs based on stochastic random search in the space of protocols and their parameters, as well as modification of test sequences by methods of genetic algorithms, bringing the proposed solutions to implementation algorithms. Practical significance: a universal automated software fuzzer for searching vulnerabilities of TCP/IP stack software in critical information infrastructure has been developed, functioning on the basis of state space parameters of the target object.