APPLICATION OF SELF-ORGANIZING MAPS FOR IMPROVING INFORMATION SECURITY SYSTEMS IN AUTOMATED SYSTEMS

The study suggests an approach to segmentation of employees of a commercial organization, carried out in order to improve the accuracy and speed of assessing the characteristics of these employees in order to identify potential information security violators in their environment. The approach proposed by the authors is based on the application of a neural network clustering model based on the use of self-organizing Kohonen maps. The construction of the model is considered using an example in which the initial data for building, training and testing the model (from employee habits in working with corporate data to behavior in the system) are collected from various sources (information base of the 1C accounting system: The enterprise, the ViPNet Endpoint Protection event logs, the database of the automated HR department system, etc.), followed by the reduction of their types, formats, and encodings to a form acceptable for the clustering model construction procedures. The collected data reflects a variety of characteristics chosen by the authors, such as the length of an employee's stay within the controlled area, access to all user accounts, the number of accesses to third-party servers/services from the workplace, the amount of downloaded data, etc. The rational characteristics of the model and the parameters of its learning process are determined experimentally. The accuracy of the model has been evaluated. The approach developed by the authors to the segmentation of the organization's employees, carried out in order to increase the accuracy and speed of assessing the characteristics of these employees in order to identify potential information security violators in their environment, will significantly reduce the work time of information security personnel while ensuring acceptable accuracy of the definitions.