The paper suggests a method of early detection of cyber-attacks by using DDoS attacks as an example) using the method of extreme filtering in a mode close real time. The process of decomposition of the total signal (additive superposition of attacking and legitimate effects) and its decomposition using the method of extreme filtering is simulated. A profile model of a stochastic network is proposed. This allows to specify the influence of the intruder on the network using probabilistic-time characteristics. Experimental evaluation of metrics characterizing the cyber-attack is given. It is demonstrated how obtained values of metrics confirm the process of attack preparation, for instance the large-scaled telecommunication network, which includes the proposed method for early detection of attacks, has a recovery time of no more than 9 s, and the parameters of quality of service remain in an acceptable range.

The article proposes an approach to ensuring the functioning of Software-Defined Networks (SDN) in cyber attack conditions based on the analytical modeling of cyber attacks using the method of topological transformation of stochastic networks. Unlike other well-known approaches, the proposed approach combines the SDN resilience assessment based on analytical modeling and the SDN state monitoring based on a neural network. The mathematical foundations of this assessment are considered, which make it possible to calculate the resilience indicators of SDN using analytical expressions. As the main indicator, it is proposed to use the correct operation coefficient for the resilience of SDN. The approach under consideration involves the development of verbal models of cyber attacks, followed by the construction of their analytical models. In order to build analytical models of cyber attacks, the method of topological transformation of stochastic networks (TTSN) is used. To obtain initial data in the simulation, the SDN simulation bench was justified and deployed in the EVE-NG (Emulated Virtual Environment Next Generation) virtual environment. The result of the simulation is the time distribution function and the average time for the cyber attack implementation. These results are then used to evaluate the SDN resilience indicators, which are found by using the Markov processes theory. In order to ensure the resilience of the SDN functioning, the article substantiates an algorithm for monitoring the state of controllers and their automatic restructuring, built on the basis of a neural network. When one is choosing a neural network, a comparative evaluation of the convolutional neural network and the LSTM neural network is carried out. The experimental results of analytical modeling and simulation are presented and their comparative evaluation is carried out, which showed that the proposed approach has a sufficiently high accuracy, completeness of the obtained solutions and it took a short time to obtain the result.

We propose an adaptive method and a vector algorithm for assessing the main characteristics of traffic in high-speed multiservice communication networks. The adaptive algorithm for assessing the characteristics of network traffic operates online. The method is based on the conditionally nonlinear Pareto-optimal filtering principle, in which the estimation of the unknown traffic parameters is performed in two stages. At the first stage, we estimate the value of the latest forecast function of unknown traffic parameters, and at the second stage, the forecast is corrected. An analysis of the research results for the method and algorithm proposed for assessing the main characteristics of traffic in high-speed multiservice communication networks has shown their high efficiency. The average relative error of the resulting estimates does not exceed 10% of the current values of the traffic characteristics being estimated.

The paper proposes a method for improving the accuracy of early detection of cyber attacks with a small impact, in which the mathematical expectation is a fraction of the total, and the pulse repetition period is quite long. Early detection of attacks against telecommunication networks is based on traffic analysis using extreme filtering. The algorithm of fuzzy logic for deciding on the results of extreme filtering is suggested. The results of an experimental evaluation of the proposed method are presented. They demonstrate that the method is sensitive even with minor effects. In order to eliminate the redundancy of the analyzed parameters, it is enough to use the standard deviation and the correlation interval for decision making.

The instability of the geopolitical situation due to the high terrorist danger leads to the need to take into account at the planning stage the capabilities of intruders to perform UAV flight missions. A general method for analyzing the process of cargo delivery by UAVs (Unmanned Aerial Vehicles) to hard-to-reach areas during emergencies has been proposed. This method allows for the evaluation of UAV effectiveness based on the probability of successful cargo delivery within a specified time limit. The method is based on applying topological transformation techniques to stochastic networks. The cargo delivery process is modeled as a stochastic network, followed by the determination of its equivalent function and the use of Heaviside decomposition to calculate the distribution function and the expected delivery time. This presentation of the studied process for the first time made it possible to take into account the impact on the flight mission of the UAV of the destructive impact from the attacker. This approach allows the destructive effects on the UAV from malicious interference to be considered. The input data used for the analysis are parameters that characterize the properties of individual processes within the stochastic network, represented as branches, which are computed using methodologies published in earlier studies. It has been demonstrated that the resulting distribution function of the mission completion time can be accurately approximated by a gamma distribution with a level of precision suitable for practical applications. In this case, the gamma distribution parameters are determined using the equivalent function of the stochastic network. The proposed method can be used by flight planners when scheduling UAV operations in emergency zones, especially in scenarios where there is a risk of malicious interference.

Cyberattacks against the elements of technological data transmission networks represent a rather significant threat of disrupting the management of regional electric power complexes. Therefore, evaluating the functioning quality of data transmission networks in the context of cyberattacks is an important task that helps to make the right decisions on the telecommunication support of electric power systems. The known models and methods for solving this problem have limited application areas determined by the admissible packet distribution laws. The paper proposes a new method for evaluating the quality of the functioning of data transmission networks, based on modeling the process of functioning of data transmission networks in the form of a stochastic network. The proposed method removes restrictions on the form of the initial distributions and makes the assumptions about the exponential distribution of the expected time and packet servicing in modern technological data transmission networks unnecessary. The method gives the possibility to evaluate the quality of the network functioning in the context of cyberattacks for stationary Poisson transmission and self-similar traffic, represented by Pareto and Weibul flows models. The obtained evaluation results are in good agreement with the data represented in previously published papers.