RECONFIGURATION METAGRAMMATICS FOR DESCRIPTION AND MODELING OF MULTI-STAGE COMPLEX ATTACKS

Abstract

The purpose of the study is determined by a significant expansion of the classes of threats to
modern automated systems, the dynamic development of tactics and techniques for attacking their
information resources. The available methods and hardware and software tools effectively resist
single-stage attacks that have a fixed scheme of destructive impact and time-limited activity. Modern
types of destructive influences are understood as multi-stage complex attacks, for which it is
important to create an adequate and effective apparatus for describing, modeling and repelling
new types of attacks. Research methods are based on the development of a structural-algebraic
approach, primarily on the apparatus of formal grammars and metagrammars. It has been established
that the well-known formal models for describing and modeling multi-stage complex attacks
are cumbersome, and their modification is difficult. Most attack descriptors are not equipped with
a representative set of methods for structural and algebraic analysis of such complexly structured
objects. To describe, model and repel such attacks, a class of reconfiguration metagrammars has
been developed. These metagrammars contain a set of regular and reconfiguration rules for
matching between grammar elements within the grammar. These rules allow you to select specific
branches of the search graph depending on the achieved parsing states. This property significantly
reduces the search space and thus increases the specific efficiency of the search. The developed
apparatus of reconfiguration metagrammars creates the necessary theoretical basis for their effective
use in modeling and reflecting existing and prospective ICAs that have a structural-linguistic
description. The resulting qualimetric five-dimensional diagram, built on a set of practically significant
indicators (homogeneity, connectivity, compactness, adaptability, directionality) showed
the advantage of reconfiguration metagrammars over general metagrammars. Methods of parsing
in reconfiguration metagrammars differ in structural rules of reconfiguration (structural adaptation)
and selection criteria for their adaptation. These procedural features make it possible to
expand the possibilities of attack modeling and improve the efficiency of procedures for repelling
multi-stage complex attacks.