Open AccessCognitive Modeling of the Cyber Attack Vector Based on CAPEC Methods
Author(s) -
Vladimir Vasilyev,
Anastasia Kirillova,
Alexey Vulfin
Publication year - 2021
Publication title -
voprosy kiberbezopasnosti
Language(s) - English
Resource type - Journals
ISSN - 2311-3456
DOI - 10.21681/2311-3456-2021-2-2-16
Subject(s) - fuzzy cognitive map , computer science , process (computing) , relevance (law) , data mining , software , fuzzy logic , automation , artificial intelligence , machine learning , computer security , fuzzy control system , neuro fuzzy , engineering , mechanical engineering , political science , law , programming language , operating system
Purpose: automation of complex attack vector modeling based on formalized CAPEC meta-pattern based on fuzzy cognitive maps. Methods: modeling a tool in the form of a graph with a further form of development in the form of a hierarchical fuzzy cognitive map for analysis using the potential level of detail and quantitative assessment of cybersecurity risks. Practical relevance: a scenario approach to modeling complex multistep targeted cyberattacks is proposed based on the draft Methodology for modeling security threats of the FSTEC of Russia and the base of meta- pattern for attacks CAPEC. The algorithm for “folding” a detailed fuzzy cognitive map of the attack vector is shown using the example of the threat of interception of control of an automated process control system of an oil company with an assessment of the probability of implementation, considering the severity level of exploited vulnerabilities. The main software modules of the system have been developed. Computational experiments were carried out to assess the effectiveness of its application. It is shown that as a result of analyzing the vector of cyberattacks in a fuzzy cognitive basis, an expert can rank possible scenarios of implementation, considering the vulnerabilities used, assess the level of danger of the implementation of each scenario separately and cyberattacks as a whole.