title: ÐÐ²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ Ð¿Ð¾ÑÑÑÐ¾ÐµÐ½Ð¸Ñ Ð³ÑÐ°ÑÐ° Ð°ÑÐ°Ðº Ð´Ð»Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼
title: Ð²ÑÐ¿ÑÑÐºÐ½Ð°Ñ ÐºÐ²Ð°Ð»Ð¸ÑÐ¸ÐºÐ°ÑÐ¸Ð¾Ð½Ð½Ð°Ñ ÑÐ°Ð±Ð¾ÑÐ° Ð±Ð°ÐºÐ°Ð»Ð°Ð²ÑÐ°
titleType: Subtitle
title: Automation of attack graph construction for information systems security analysis
Creators: name: ÐÑÑÐµÐ½ÐºÐ¾, ÐÐ½Ð´ÑÐµÐ¹
Publisher: name: Ð¡Ð°Ð½ÐºÑ-ÐÐµÑÐµÑÐ±ÑÑÐ³ÑÐºÐ¸Ð¹ Ð¿Ð¾Ð»Ð¸ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¸Ð¹ ÑÐ½Ð¸Ð²ÐµÑÑÐ¸ÑÐµÑ ÐÐµÑÑÐ° ÐÐµÐ»Ð¸ÐºÐ¾Ð³Ð¾
Year: 2024
Subjects: Ð°Ð½Ð°Ð»Ð¸Ð· Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸
ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ðµ Ð½Ð° Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ðµ
Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ñ
Ð³ÑÐ°Ñ Ð°ÑÐ°Ðº
security analysis
penetration testing
automation
attack graph

description: Ð¦ÐµÐ»ÑÑ ÑÐ°Ð±Ð¾ÑÑ ÑÐ²Ð»ÑÐµÑÑÑ Ð¿Ð¾Ð²ÑÑÐµÐ½Ð¸Ðµ ÑÑÑÐµÐºÑÐ¸Ð²Ð½Ð¾ÑÑÐ¸ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ ÐÐ¡ Ð¿ÑÑÐµÐ¼ Ð²Ð½ÐµÐ´ÑÐµÐ½Ð¸Ñ ÑÐ¸ÑÑÐµÐ¼Ñ Ð°ÑÑÐ¸ÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ. ÐÐ°Ð´Ð°ÑÐ¸, ÑÐµÑÐ°ÐµÐ¼ÑÐµ Ð² ÑÐ¾Ð´Ðµ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ: 1. ÐÑÐ¾Ð²ÐµÑÑÐ¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ðµ Ð½Ð°ÑÑÐ½Ð¾-ÑÐµÑÐ½Ð¸ÑÐµÑÐºÐ¾Ð¹ Ð»Ð¸ÑÐµÑÐ°ÑÑÑÑ Ð´Ð»Ñ Ð²ÑÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð¿ÑÐµÐ¸Ð¼ÑÑÐµÑÑÐ² Ð¸ Ð½ÐµÐ´Ð¾ÑÑÐ°ÑÐºÐ¾Ð² ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ Ð¿Ð¾Ð´ÑÐ¾Ð´Ð¾Ð² Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸. 2. ÐÑÐ´ÐµÐ»Ð¸ÑÑ Ð¾ÑÐ½Ð¾Ð²Ð½ÑÐµ ÐºÐ°ÑÐµÐ³Ð¾ÑÐ¸Ð¸ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÑÑÐµÐ´ÑÑÐ², Ð¿ÑÐµÐ´Ð½Ð°Ð·Ð½Ð°ÑÐµÐ½Ð½ÑÑ Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ðµ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ñ ÑÐµÑÐµÐ½Ð¸Ð¹. 3. Ð Ð°Ð·ÑÐ°Ð±Ð¾ÑÐ°ÑÑ Ð¼Ð¾Ð´ÐµÐ»Ñ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð°Ð½Ð½ÑÑ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ Ð³ÑÐ°ÑÐ° Ð°ÑÐ°Ðº Ð´Ð»Ñ Ð¸ÑÐ¿Ð¾Ð»ÑÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð² Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ Ð¸ Ð¿Ð¾Ð»ÑÐ°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼Ð°Ñ, Ð¿ÑÐµÐ´Ð½Ð°Ð·Ð½Ð°ÑÐµÐ½Ð½ÑÑ Ð´Ð»Ñ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ðµ. 4. Ð ÐµÐ°Ð»Ð¸Ð·Ð¾Ð²Ð°ÑÑ ÑÐ¸ÑÑÐµÐ¼Ñ Ð°ÑÑÐ¸ÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð² ÑÐ°Ð¼ÐºÐ°Ñ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ ÑÐµÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð½Ð° Ð¿ÑÐ¾Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ðµ Ð½Ð° Ð¾ÑÐ½Ð¾Ð²Ðµ ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð½Ð¾Ð¹ Ð¼Ð¾Ð´ÐµÐ»Ð¸ Ð´Ð°Ð½Ð½ÑÑ. Ð ÑÐ¾Ð´Ðµ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð¸ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ñ ÑÑÑÐµÑÑÐ²ÑÑÑÐ¸Ðµ Ð¼ÐµÑÐ¾Ð´Ñ, Ð¸ÑÐ¿Ð¾Ð»ÑÐ·ÑÐµÐ¼ÑÐµ Ð² Ð°Ð½Ð°Ð»Ð¸Ð·Ðµ Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸, ÑÐ°Ð·Ð»Ð¸ÑÐ½ÑÐµ Ð²Ð¸Ð´Ñ Ð¸Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð°ÑÐ¸Ð¸ Ð¸ ÐºÐ¾Ð½ÑÐµÐ¿ÑÐ¸Ð¸ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð¿Ð¾Ð»ÑÑÐµÐ½Ð½ÑÑ Ð´Ð°Ð½Ð½ÑÑ Ð¾Ð± Ð¸ÑÑÐ»ÐµÐ´ÑÐµÐ¼Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ðµ. Ð ÑÐµÐ·ÑÐ»ÑÑÐ°ÑÐµ Ð²ÑÐ¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ ÑÐ°Ð±Ð¾ÑÑ Ð±ÑÐ»Ð° ÑÐ°Ð·ÑÐ°Ð±Ð¾ÑÐ°Ð½Ð° Ð¼Ð¾Ð´ÐµÐ»Ñ Ð¿ÑÐµÐ´ÑÑÐ°Ð²Ð»ÐµÐ½Ð¸Ñ Ð´Ð°Ð½Ð½ÑÑ Ð´Ð»Ñ Ð°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ Ð¸ Ð¿Ð¾Ð»ÑÐ°Ð²ÑÐ¾Ð¼Ð°ÑÐ¸Ð·Ð¸ÑÐ¾Ð²Ð°Ð½Ð½ÑÑ ÑÐ¸ÑÑÐµÐ¼ Ð¸ ÑÑÐµÐ´ÑÑÐ²Ð¾, Ð¿ÑÐµÐ´Ð½Ð°Ð·Ð½Ð°ÑÐµÐ½Ð½Ð¾Ðµ Ð´Ð»Ñ Ð°ÑÑÐ¸ÑÑÐ¸ÑÐ¾Ð²Ð°Ð½Ð¸Ñ Ð°ÑÐ´Ð¸ÑÐ¾ÑÐ° Ð²Ð¾ Ð²ÑÐµÐ¼Ñ Ð¿ÑÐ¾Ð²ÐµÐ´ÐµÐ½Ð¸Ñ Ð°Ð½Ð°Ð»Ð¸Ð·Ð° Ð·Ð°ÑÐ¸ÑÐµÐ½Ð½Ð¾ÑÑÐ¸ Ð¸Ð½ÑÐ¾ÑÐ¼Ð°ÑÐ¸Ð¾Ð½Ð½Ð¾Ð¹ ÑÐ¸ÑÑÐµÐ¼Ñ.
description: The purpose of the work is to improve the efficiency of analyzing the security of IS by implementing an assisting system. The tasks to be solved in the course of the research: 1. To conduct a study of scientific and technical literature to identify the advantages and disadvantages of existing approaches of security analysis. 2. To identify the main categories of automated tools designed to conduct penetration testing based on the analysis of existing solutions. 3. Develop an attack graph-based data representation model for use in automated and semi-automated systems designed for penetration testing. 4. To realize the system of assistance in the framework of penetration testing on the basis of the developed data model. During the work the existing methods used in security analysis, different types of their automation and concepts of presentation of the obtained data about the system under study were investigated. As a result of the work, a data representation model for automated and semiautomated systems and a tool designed to assist the auditor during the security analysis of the information system were developed.