Methodology for assessing the security of critical information infrastructure objects based on semantic analysis and graph attack models

The subject of the research is the development of a methodology for assessing the level of security of critical information infrastructure (CII) objects in the financial sector under conditions of digitalization and the increasing complexity of information systems. Unlike traditional approaches that rely on static vulnerability metrics (e.g., CVSS), this study aims to create a formalized model that takes into account the context of threats, their interrelations with assets, and the dynamics of attacking behavior. The relevance of the topic is determined by the need to transition from expert and intuitive assessments to reproducible methods that ensure objectivity and interpretability of results. The study examines semantic analysis of textual descriptions of threats, ontological modeling of attack techniques, and graphical representation of intrusion routes. This comprehensive approach enables the identification of critical infrastructure nodes and a justified prioritization of security measures. The methodology is based on combining semantic analysis of threat descriptions, ontological interpretation of attack techniques according to MITRE ATT&CK, and constructing a graphical model of the infrastructure with subsequent calculation of the formalized security metric Z. These stages are integrated into a single analysis system to obtain a quantitative and context-dependent assessment of security. The scientific novelty of the research lies in combining semantic analysis and ontological modeling with a graphical model of attacks to construct the formalized security metric Z. Unlike classical approaches, the metric considers not only the likelihood of threat realization but also the criticality of assets, as well as the context of attacking behavior. Experiments showed that values of Z correlate with the configuration of vulnerabilities and allow for more accurate identification of critical nodes in the system. For instance, the access gateway demonstrated a low level of security (Z=0.32), while the DNS server proved to be the least vulnerable (Z=0.88). Such analysis provides the opportunity to redistribute protection resources and strengthen control over priority components. The visualization of attack routes provides a clear understanding of potential vectors of intrusion and facilitates decision-making regarding enhanced protection. Thus, the proposed methodology forms the basis for a more accurate and interpretable assessment of the cyber resilience of CII objects, improving risk management efficiency and the adaptability of security systems in the context of a dynamically changing cyber threat landscape.