An approach to modeling the decision support process of the security event and incident management based on Markov chains. Issue 13 (2019)

• Record Type: Journal Article
• Authors: Kotenko, Igor; Parashchuk, Igor
• Is Part Of: IFAC-PapersOnLine. Volume 52:Issue 13(2019)
• Page Start: 934
• Page End: 939
• Publication Date: 2019
• Subjects: cyber attacks -- security event -- incident management -- decision support -- quality indicator -- Markov chain -- difference stochastic equation; Automatic control -- Periodicals; 629.805
• DOI: 10.1016/j.ifacol.2019.11.314
• Languages: English
• ISSNs: 2405-8963

Abstract

Abstract: An approach to the specification of the dynamics of changes in the values of quality indicators, which characterize the decision support process for security event and incident management, is proposed. The approach is based on analyzing the processes of cyber attack detection and prevention and analyzing the decision support processes for managing the structure, parameters and work modes of detection and prevention systems. It also uses controlled Markov chains in the form of difference stochastic equations. The considered mathematical representation of the state change dynamics allows one to formalize and structure the specification of this type process taking into account its requirements for operativeness (timeliness), validity (veracity), secrecy and resource costs.