Функціональна модель системи виявлення та прогнозування кіберзагроз для корпоративних комп’ютерних мереж з використанням експертних оцінок

The use of expert systems as a separate entity for solving cyber security problems is a sufficiently detailed researched issue. In contrast, the creation of a composition of methods that would contain components of cyber threat detection and forecasting to fill the knowledge base of expert systems is a problem that is less researched. Modeling such a comprehensive approach can expand the capabilities of the expert system and increase the accuracy of assessing cyber security risks and possible countermeasures against cyber threats. In this work, we present functional modeling using IDEF0 diagrams of the cyber threat detection and forecasting system for corporate computer networks using expert assessments. In the created model, it is proposed to use components for detecting and predicting cyber threats as a source of filling the expert system's knowledge base, which, combined with expert assessments and the Game theory model, will generate reports and recommendations on cyber security. We suggest to use CVSS score of a cyber threats with or without countermeasures as a quantitative measure for the expert assessments. For generating cyber defense recommendations, we create a zero-sum matrix game which is solved with an iterative algorithm. CVSS assessments are used as the payoffs in the matrix game. Detection of network traffic anom-alies using Chaos Theory and Ewma statistics, classification of malicious network traffic, and classification of malicious binary files are proposed as methods of threat detection. To predict the probabilities of network threats, the application of the Bayesian network is proposed. The work describes system activities, resources, and execution mechanisms according to IDEF0 specifi-cations. Decomposition of the activity "detection and prediction of cyber threats using expert systems" and "detection of cyber threats and network anomalies" was made. As a result, we presented a model for detecting and predicting cyber threats using expert assessments, which allows us to expand the capabilities of the expert system for the assessment of cyber security risks and possible countermeasures against cyber threats.