One of the reasons for the implementation of information security threats in organizations is the insider activity of its employees. There is a big challenge to detect stego-insiders-employees who create stego-channels to secretly receive malicious information and transfer confidential information across the organization’s perimeter. Especially presently, with great popularity of wireless sensor networks (WSNs) and Internet of Things (IoT) devices, there is a big variety of information that could be gathered and processed by stego-insiders. Consequently, the problem arises of identifying such intruders and their transmission channels. The paper proposes an approach to solving this problem. The paper provides a review of the related works in terms of insider models and methods of their identification, including techniques for handling insider attacks in WSN, as well methods of embedding and detection of stego-embeddings. This allows singling out the basic features of stego-insiders, which could be determined by their behavior in the network. In the interests of storing these attributes of user behavior, as well as storing such attributes from large-scale WSN, a hybrid NoSQL database is created based on graph and document-oriented approaches. The algorithms for determining each of the features using the NoSQL database are specified. The general scheme of stego-insider detection is also provided. To confirm the efficiency of the approach, an experiment was carried out on a real network. During the experiment, a database of user behavior was collected. Then, user behavior features were retrieved from the database using special SQL queries. The analysis of the results of SQL queries is carried out, and their applicability for determining the attribute is justified. Weak points of the approach and ways to improve them are indicated.

In view of the growth of scale and significance of information structure the problem in ensuring information safety and skilled technician training in this field becomes more and more urgent. A virtual laboratory within the use of which one could carry out own investigations will render in this work a considerable assistance. In this paper there is described a method for virtual laboratory creation with the aid of which it would be possible to carry out testing for penetration and to analyze methods ensuring safety for information systems. In the course of this laboratory creation there was used license software taking into account system requirements of the computer in which this laboratory was accommodated. Further in this paper there was considered a method for penetration testing on Metasploitable 2 vulnerable machine pre-configured. Next stage of the work consists in the realization and thorough consideration of potentialities in the application of the created laboratory for the simulation of own scripts by the example of Drupal vulnerable version. In the course of the operation there was shown a code for Python allowing the fulfillment of remote code carrying out. The purpose of this work was the formation of environment allowing the mastery for hacker’s action estimate and the analysis the origin of system certain vulnerable places. The actual skills obtained will render assistance in the information safety increase of actual information systems.

Objective. When integrating the ELK stack into an information system, it is necessary to have a duplicate Java application in a closed circuit for hidden anomaly processing. It is necessary to develop the architecture of a Java application for hidden integration with the information system.Method. The research used methods of analyzing information in information system logs, static analysis methods, programming for application development, and data processing algorithms.Result. An example of implementing the Elasticsearch stack for processing and storing logs is presented. An implementation of anomaly analysis using the official Elasticsearch library is proposed. Options for using Elasticsearch for anomaly analysis are considered, an implementation of anomaly analysis using the official Elasticsearch library is proposed. The architecture of a Java application integrated into an information system for automated log analysis in order to detect computer attacks or signals of their onset by searching for anomalies is proposed. Variants of anomalies in information system logs are considered and actions for their detection are described. A generalized map of the Java application workflow is demonstrated.Conclusion. The architecture of a Java application implementing the analysis of logs of an information system for key anomalies has been developed.

The number of crimes committed by insiders has increased dramatically over the past 10 years. Insiders use various technologies, including steganography, to bypass security measures and steal confidential information. In this paper, we analyse the methods that can be used to identify the steganographic channel and steganographic insider, such as Shannon information entropy method, Kolmogorov-Smirnov method, probability distribution variance comparison method, machine learning method and neural network method. Based on these methods, some programs were written to identify steganographic channels in the network. Each of the methods was tested on real enterprise traffic. As a result it is possible to say whether these methods are suitable for use in the enterprise network or nor.

Введение: диагностирование психических заболеваний представляет собой сложный процесс, который включает проведение диалоговых бесед, анализ поведения обследуемого и прохождение им специализированных тестов. На успешное решение данной задачи может влиять как отсутствие знаний и опыта психолога, так и наличие противоречивых или неполных исходных данных со стороны пациента. Для устранения последнего недостатка разрабатываются экспертные или интеллектуальные системы. Цель: разработать методику определения психического состояния пользователей социальной сети. Результаты: с помощью методов машинного обучения разработана методика, предназначенная для определения типа психического состояния пользователей социальной сети. Новизна предлагаемой методики заключается в наличии двухшаговой процедуры предварительной обработки текста и построении нескольких наборов признаков, описывающих эмоциональное настроение пользователей социальной сети на уровне публикуемых ими сообщений. В качестве исходных данных привлекались текстовые сообщения пользователей социальной сети Reddit. В методике выделяются три этапа: 1) сбор данных, 2) предварительная обработка данных, 3) разметка постов и построение признаков. Оценка функционирования программного средства, построенного на основе данной методики, проводилась по четырем показателям: достоверность, точность, полнота и F-мера. Наилучшие результаты демонстрирует ансамбль, построенный на основе подхода One-vs-Rest, где в качестве базовых решателей выступают линейные машины опорных векторов. Практическая значимость: результаты исследования могут применяться при построении вспомогательных систем, которые направлены на поддержку принятия решений специалистами-психологами при определении психических нарушений.

Trends in modern security technologies with honeypot technologies use are analyzed to detect and explore intruders’ behavior for counteract measures development. Scalable solution proposed and tested within Microsoft Azure exploratory installation. DDoS attack stress test of the solution is performed.