METHOD OF CLASSIFICATION OF PSEUDO-RANDOM SEQUENCES OF COMPRESSED AND ENCRYPTED DATA TO PREVENT INFORMATION LEAKAGE
Authors:   Taras Shevchenko National University of Kyiv, Kyiv, Ukraine, Lienkov S.V. , Dzhuliy V.M. ,   Khmelnytskyi National University, Khmelnytskyi, Ukraine, Muliar I.V. ,   Khmelnytskyi National University, Khmelnytskyi, Ukraine
Published: October 2024

The considered task of developing a method for classifying pseudo-random sequences of protection against the leakage of confidential information based on the division of compressed and encrypted data can be used to detect network attacks on data transmission networks, in means of prevention and detection of information leakage, as well as in software products that implement services of electronic mail. It is shown that data security threats are characterized by a set of qualitative and quantitative vector indicators, and their formalization requires the application of fuzzy set theory and discrete mathematics. It is shown that it is impossible to use expert traditional assessment methods to determine most of the considered indicators. To minimize the risk of leakage of confidential information, it is suggested to form groups of employees and calculate the risk of leakage of confidential data for each of them. Modern means of preventing and detecting information leaks use various methods of data flow analysis. The main ones include contextual and content methods. The above methods are not able to detect a data leak in compressed and encrypted form, and the addition of digital signatures allows you to mask encrypted data as compressed in a simple way, in the field of information security, behavioral methods of data flow analysis and machine learning algorithms have found wide use. One of the main difficulties in this situation is the construction of data models, processing and search of the feature space. The proposed method of classifying pseudo-random sequences takes into account the discriminating ability of statistical features, it can be implemented into existing means of preventing and detecting information leaks in order to eliminate the mentioned shortcomings. An encrypted data stream can be transmitted from employee workstations, various information systems, and network storage. To evaluate the effectiveness of the proposed method of protection against leakage of confidential data, experiments were conducted to determine the accuracy of binary classification of compressed and encrypted data depending on the types of input sequences subjected to compression procedures. In the course of practical implementation, a quantitative assessment of the classification accuracy of pseudorandom sequences was carried out depending on the parameters of the proposed classifier. The choice of the subsequence length of nine bits is justified as the most rational value, which allows to achieve classification of pseudo-random sequences with high accuracy and minimal time for the classification procedure. The choice of the optimal scanning window of the classifier with a size of 500 kb is justified. Depending on the requirements for accuracy and speed of data analysis, two modes of operation are proposed: scanning of a randomly selected fragment of a file with a size of 500 kb; scanning the entire file with a 500 KB scanning window. A description of the places of implementation of the proposed method of classifying pseudo-random sequences into e-mail protection subsystems, network attack detection systems, means of preventing and detecting information leaks is given. A comparative evaluation of the proposed algorithm with known analogues in the subject area of research was carried out.