Optimization of diagnosis of unauthorized actions in a computer network

Abstract

The problem of diagnosing unauthorized actions in computer networks is analyzed in order to optimize the protocols of their work and increase efficiency. Considered possibilities of processing the diagnosis of intrusions through binary symptoms. Introduced Mass of Conviction that will accurately regulate the selection of the necessary symptoms for the formation of diagnoses. Equations of the model for diagnosing intrusions are given. Ways to optimize the improvement of malware detection and attacks on a computer network are proposed. The necessary criteria and requirements are formulated to ensure timely detection of intrusions into computer networks. The ways of optimizing diagnostics and the possibility of autonomous detection of unauthorized actions (without using and accessing signature databases) have been formed. It is proposed to describe sets of states by predefined structures, that will make it possible to group the necessary actions and speed up their processing. Introduced ability to classify the quality of symptoms, that will automatically replace weak symptoms with strong ones.