A METHOD FOR DETECTING TARGETED ATTACKS IN EARLY PHASES

Purpose of the study: development of a method for early detection of targeted attacks based on retrospective analysis of the state of the protected object. Methods of research: comparative analysis within the framework of the system approach; synthesis of the structure of the retrospective method; synergetics; methods of formal logic. Result(s): a comprehensive analysis of the properties of targeted attacks and the peculiarities of their implementation at early stages is performed, which allows for a deeper understanding of the mechanisms used by attackers to achieve their goals. The regularities of changes in the state of critical information infrastructure objects in different operating conditions under the influence of targeted attacks are considered. Characteristic signs signaling the beginning of an attack are revea led, which serves as a basis for the development of effective defense methods. For early detection of targeted attacks, an original method based on the comparison of the state of the object under study, subjected to external targeting, at different points in time is developed. A method of increasing the reliability of attack detection using formal logic is proposed. Scientific novelty: synthesized method of early detection of targeted computer based on the analysis of changes in the state of the protected object under the influence of destructive impact; proposed a way to increase the reliability of detection of the hidden phase of a targeted attack on the basis of optimal threshold values and the use of logical procedures.