# Cyber Security Risk Modeling in Distributed Information Systems
## 4 Materials and Methods
### Model Training  
The practical implementation of the analytical module is based on the Scikit Learn library toolkit. The result of the simulation is the construction of a mathematical model that can predict the level of threats to a particular information asset based on various network metrics [74; 75].  
A dataset with 13,520 records was used to train the neural network component. The initial number of analyzed metrics is 235. Using principal component analysis, 67 informative parameters were identified. These are the predictors based on which the target attribute is calculated.  
The initial dataset was divided into a data set for training (75% of the initial) and a data set for testing (25%). The piloting data is a numerical matrix of dimension m \(\times\) (n + 1), in which the number of rows m corresponds to the size of the training sample, the first n columns--the value of the input variables of the model, and the last--the value of the output variable.  
Although there are no formal recommendations for the number of rows of the test sample matrix, it is assumed that the quality of learning of the neural network and, consequently, the accuracy of the results obtained is proportional to the size of the training sample. As for the number of columns, in our case, for the analysis of the level of threats, it is 68 at the initial stage and changes dynamically depending on the number of categorical metrics, the number of which increases proportionally with an increasing volume of the training set.  
A fragment of the test (or pilot) sample is shown in Table 3.  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**Metrics Name** & **Description** & **Impact on Final Risk Score** & **Example of Value** \\ \hline Type & Device type & High & PC/NB/TAB/SRV/SRD \\ \hline Last scan & Date-time of the last scan or & & \\ mapping & & High & 20 April 2020 22:02 \\ \hline AV Type & Type of antivirus & High & McAfee/WinDefender \\ \hline Last logon & Date-time of the last login & Low & 15 April 2020 19:40 \\ \hline OS Type & Operating system type & High & Windows Server 2008 R2 \\ \hline OS Version & Operating system version & Moderate & 6.1 \\ \hline OS Build Number & Operating system build version & Moderate & 7600 \\ \hline Blocked in AD & Lock status in Active Directory & Moderate & Yes/No \\ \hline Last Asset Update & Last update date of the asset & Low & 8 November 2019 9:02 \\ \hline Vulnerabilities & Number of found & High & 3 \\ \hline Critical VLAN & Does the network belong to & & \\ critical & High & Yes/No \\ \hline Wireless & Is the network wireless & Moderate & Yes/No \\ \hline Last Event & Date-time of the last event in & & 22 April 2020 16:22 \\ \hline Backup Status & Is the backup performed & High & Yes/No \\ \hline Defender Last Update & Time of last Windows Defender & High & 23 April 2020 0:02 \\ \hline McAfee Version & McAfee Agent version & Moderate & 5.6.1.157 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Example of distributed metadata and asset metrics.  
For some informative parameters, it is necessary to carry out post-processing and their presentation for model learning because the Scikit Learn toolkit for building neural networks cannot accept input of categorical (text) format and further process them. Most metrics are categorical, so at this stage they need vectorization.