Andrii Gizun

Nowadays solving practical problems in various sectors using intelligent solutions, based on expert systems are becoming more and more widespread. In this paper an expert system method is proposed for assessment and prediction of destructive influences. All disadvantages of existing assessment systems are taken into account during the development and analysis phases. The most important estimated parameters are determined. This method is based on quantitative methods of expert evaluation, which gives the advantage: there is no need to collect large amounts of statistical data and clear formalization of the current situation.

Cyber incidents can disrupt regular mode of information and telecommunication systems functioning and to cause the substantial material and image losses for the company. One of the approaches in incident management is the use of the theory of network-centric management for cyber incidents monitoring, but is not formalized stage of forming basic rules set. In this regard, in this work developed the method for rules set forming of cyber incidents extrapolation in network-centric monitoring, which allows to automate and increase accuracy operation of network-centric systems for information and telecommunication systems monitoring by determining possible types of cyber attacks and cyber incidents categories, forming vector-matrix of cyber incidents probability, cyber incidents ranging by their importance and determining limit values of probability, forming cyber incidents possibility indicators, and also development and establishment of cyber incidents extrapolation rules.

Today incident detection mechanisms, that define CERT / CSIRT effectiveness, based mostly on two principles - signature and heuristic. Their disadvantage is that they are focused on mathematical models, which require a lot of time to prepare statistics and so it decreases CERT/CSIRT efficiency. In this work, we have proposed approaches to ensure CERT / CSIRT high efficiency and its evaluation. To detect incidents we suggest using mathematical models based on expert's estimations. The proposed method allows solving the problem of incident detection and its identification based on expert judgments in fuzzy conditions. To estimate CERT / CSIRT effectiveness was introduce baselines. It enabled to determine CERT / CSIRT effectiveness during the necessary period. The report by the following parameters should be carried out regularly to get the full picture of their changes and identify the main trend.