VULNERABILITY ASSESSMENT OF AUTOMATED SYSTEMS USING PROBABILITY THEORY, STUDENT'S DISTRIBUTION, AND NORMAL RANDOM VARIABLES

Purpose of the study: the study of indicators and mathematical methods for assessing vulnerabilities of automated systems. Consideration of the applicability of probability theory, Student's distribution, and normal random variables in order to comprehensively assess vulnerabilities. Methods of research: probability theory, Student's distributions, and normal random variables. The object of the study is an automated system with quantitative indicators (in terms of the number of components and the number of vulnerabilities in them). Result(s): the obtained mathematical models of vulnerability assessment significantly reduce the level of uncertainty associated with determining the criticality of threats and their likelihood. The use of statistical methods such as probability theory and Student's distribution allows for a more objective and reproducible assessment of vulnerabilities, excluding subjective factors from the process. In particular, the use of such methods helps to take into account various variations in vulnerability parameters, such as the likelihood of their exploitation, possible consequences and risks, which makes the process more accurate and data-driven. This is especially important in situations where it is necessary to work with limited or incomplete data, such as when evaluating new or subtle vulnerabilities. In addition, these models contribute to a significant reduction in the influence of the human factor, which is critical to ensure the objectivity and stability of the assessment. While expert assessment is an important element in traditional analysis methods, mathematical models minimize the need for subjective decisions, which in turn increases accuracy and reduces the likelihood of errors caused by personal interpretation of data. As a result, the use of such models leads to a more automated and objective vulnerability assessment process, which contributes to improved information security risk management and increased security of automated systems. Scientific novelty: it consists in the application of probability theory, Student's distribution and normal random variables in order to reduce uncertainty in assessing the vulnerabilities of automated systems. The proposed models, unlike existing ones, allow the use of numerical indicators obtained experimentally, unlike methods (for example, CVSS) using expert assessment.