Preliminary Processing of Data From Information and Communication Systems for the Task of Preventing Cyberattacks

Аннотация

The article describes pre-processing of data from endpoints and network devices, aimed at reducing the amount of processed data. An approach to detecting distributed denial of service attacks in information and communication systems based on two-stage data aggregation is considered. The flow of control commands must be regularly monitored and controlled, since the control device is a desirable target for an attacker. Circulating sent traffic flows also need to be monitored and analysed to detect cyber-attacks on information and communication systems. Research has shown that in order to prevent computer attacks on information and communication systems, it is necessary to detect anomalies in the operation of system components as early as possible with high accuracy. Due to the speed and specificity, it is difficult to determine that a system is under attack, since conventional tools do not detect the type of denial of service threats. To ensure the security and stable operation of network resources, it is necessary to implement an approach based on detecting DDOS attacks in information and communication systems. Since distributed denial of service attacks have caused significant financial losses worldwide in recent years. This article is aimed at solving problems related to ensuring information security in information and communication systems and preventing DDOS attacks in them. 1 INTRODUCTION Among the ICS of the critical transport industry, one can distinguish “smart” airports equipped with a large number of intelligent devices. Among them is Modern information and communication systems the international airport in Dubai, equipped by HDL, (ICS) are at the stage of active development. The a global manufacturer of Smart Home automation development of ICS has a significant impact on the systems, with a large number of smart devices. HDL transformation of all branches of human activity, has completed the integration of airport building including critical ones [1]. automation systems, in particular, lighting The energy industry is actively developing both in automation equipment, video surveillance control Uzbekistan and abroad. One of the priority areas for systems, baggage handling and conference room the development and digitalization of the energy management in several terminals [3]. sector is the creation of intelligent energy supply Among the ICS of the critical transport industry, networks Smart Grid - a new type of cyber-physical it is also worth noting intelligent traffic control systems that implement distributed energy exchange systems that receive information from cars, smart using “smart” devices [2]. traffic lights and various sensors that roads are In recent years, the vast majority of industrialized equipped with. countries have begun to implement programs and The specificity of modern ICS, from the point of projects in the direction of Smart Grid, covering a view of information security, lies in the following wide range of problems and tasks. The most large- factors: scale programs and projects have been developed and 1. A large number of smart devices that are part of are being implemented in the USA, Canada and EU modern ICS have vulnerabilities that allow attackers countries, as well as in China, South Korea and Japan. to use such devices as points of illegitimate automated and cyber-physical systems all over the penetration into ICS. world. 2. The heterogeneity and large volume of data generated by smart devices, along with network devices, servers and personal computers, greatly 2 METHODS AND MATERIALS complicate and slow down the process of security analysis. On large amounts of data, anomalies caused Currently, the most common way to implement by low-intensity and short-term computer attacks also attacks on end devices, whether it is a user's personal become invisible. computer or sensors and controllers in the Internet of 3. ICS have a communication environment, Things system, are network attacks [4]. With the help which, together with the fact that the mutual control of network attacks, it is possible to: exploit of the components with each other is implemented by vulnerabilities in the device software, remote control exchanging data, allows us to assume that data flows through embedded malicious software, create botnet from the ICS components will not always be networks, as well as disable nodes associated with controlled by a person. This entails security problems critical areas of human activity, which can lead to associated with hidden illegitimate influence on the serious consequences. operation of the system. Distributed denial-of-service (DDOS) attacks 4. ICS implement irreversible physical processes have led to significant financial losses worldwide [5]. along with reversible informational ones. The The results presented are consistent with the growing information processes of such systems are aimed at number of devices connected to the Internet. This ensuring the correct funct