Models and Methods for Assessing Intruder’s Awareness of Attacked Objects

The formation of strategies and tactics of destructive impact (DI) at the stages of complex computer attacks (CCAs) largely depends on the content of intelligence data obtained by the intruder about the attacked elements of distributed information systems (DISs). This study analyzes scientific papers, methodologies and standards in the field of assessing the indicators of awareness of the intruder about the objects of DI and symmetrical indicators of intelligence security of the elements of the DIS. It was revealed that the aspects of changing the quantitative and qualitative characteristics of intelligence data (ID) at the stages of CCA, as well as their impact on the possibilities of using certain types of simple computer attacks (SKAs), are poorly studied and insufficiently systematized. This paper uses technologies for modeling the process of an intruder obtaining ID based on the application of the methodology of black, grey and white boxes and the theory of fuzzy sets. This allowed us to identify the relationship between certain arrays of ID and the possibilities of applying certain types of SCA end-structure arrays of ID according to the levels of identifying objects of DI, and to create a scale of intruder awareness symmetrical to the scale of intelligence protection of the elements of the DIS. Experiments were conducted to verify the practical applicability of the developed models and techniques, showing positive results that make it possible to identify vulnerable objects, tactics and techniques of the intruder in advance. The result of this study is the development of an intruder awareness scale, which includes five levels of his knowledge about the attacked system, estimated by numerical intervals and characterized by linguistic terms. Each awareness level corresponds to one CCA stage: primary ID collection, penetration and legalization, privilege escalation, distribution and DI. Awareness levels have corresponding typical ID lists that can be potentially available after conducting the corresponding type of SCA. Typical ID lists are classified according to the following DI levels: network, hardware, system, application and user level. For each awareness level, the method of obtaining the ID by the intruder is specified. These research results represent a scientific contribution. The practical contribution is the application of the developed scale for information security (IS) incident management. It allows for a proactive assessment of DIS security against CCAs—modeling the real DIS structure and various CCA scenarios. During an incident, upon detection of a certain CCA stage, it allows for identifying data on DIS elements potentially known by the intruder and eliminating further development of the incident. The results of this study can also be used for training IS specialists in network security, risk assessment and IS incident management.