Abstract:
The number of new cybersecurity threats and opportunities is increasing over time, as well as the amount of
information that is generated, processed, stored and transmitted using ICTs. Particularly sensitive are the objects of critical
infrastructure of the state, which include the mining industry, transport, telecommunications, the banking system, etc.
From these positions, the development of systems for detecting attacks and identifying intruders (including the critical
infrastructure of the state) is an important and relevant scientific task, which determined the tasks of this article. The paper
identifies the main factors influencing the choice of the most effective method for calculating the importance coefficients
to increase the objectivity and simplicity of expert assessment of security events in cyberspace. Also, a methodology for
conducting an experimental study was developed, in which the goals and objectives of the experiment, input and output
parameters, the hypothesis and research criteria, the sufficiency of experimental objects and the sequence of necessary
actions were determined. The conducted experimental study confirmed the adequacy of the models proposed in the work,
as well as the ability of the method and system created on their basis to detect targeted attacks and identify intruders in
cyberspace at an early stage, which is not included in the functionality of modern intrusion detection and prevention
systems.
