We devised a decision support system (DSS) for the weakly formalized problems of information protection and the provision of cybersecurity at the informatization objects. The system is based on the models that describe the tasks of information safety and cyberprotection in the conceptual and functional aspects. We described the process of compiling a knowledge base of DSS for the circumstances related to the detection of hard-to-explain attributes of anomalies and attacks. The DSS "Decision Support System of Management protection of information – DMSSCIS", which we designed, makes it possible to improve understanding of the analyzed situations that occur in the process of cyberprotection of mission critical computer systems. While tested at the enterprises, it was established that the "DMSSCIS" system enabled effective visualization and interpretation of results of current assessment of the revealed hard-to-explain attributes of anomalies and cyberattacks, as well as allowed us to describe current situation in the course of multistage targeted cyberattacks. It was established that the application of DSS "DMSSCIS" in the interaction with other systems for the intelligent recognition of illegitimate interference in the computer systems operations made it possible to improve efficiency of decision making on information security. While testing, it was found that the application of the "DMSSCIS" system allowed reducing the time required to inform persons, responsible for cybersecurity, about the incidents by 6.9–7.2 times.

The results of the research aimed at the further development of detection models of cyber threats, as well as of common classes of anomalies and cyber-attacks in mission critical computer systems (MCCS) are presented. It is shown that one of the promising directions of synthesis of adaptive systems of detection and prevention of cyber-attacks is the application of models of logical procedures of detection, based on the coverage matrices of features of anomalies, threats and cyber-attacks within the known and new classes of the MCCS intrusions. The model of detection of cyber-attacks, anomalies and threats to MCCS was designed, which is based on the application of learning samples in the form of matrices of features and elementary classifiers for each of the modeled classes. The studies on minimization of the number of training samples, represented in a binary form of discerning features were carried out. The program "Threat Analyzer” was developed which allows automatic generation of dimensions of training matrix of features of anomalies, cyber threats, or cyber-attacks, without requiring the participation of experts. It is shown that for the object detection within known classes of cyber threats, attacks, anomalies, the usage in the training matrices of representative sets of 3-4 features long allows maximizing the effectiveness of the algorithm, reaching up to 98 %.

We proposed an architecture for a protection control system of the object of informatization (OBI) with the subsystem of intelligent support for making decisions on the operational management of cyberprotection. The proposed architecture, in particular, can be used under conditions of the incompleteness of knowledge about the state of OBI protection. We developed a model for the operational management of cyberprotection at OBI and formed a rational complex of protection means. The model is based on the morphological approach. The model allows, taking into account morphological matrices for each of the five proposed perimeters prepared by the intelligent decision-making support system (IDMSS), generation of variants of sets that consider the compatibility of software and hardware tools of information protection. It is proposed to make the choice on the optimal variant of a set for the perimeter using an objective function that maximizes the ratio of the summary indicator "protection of information" to the summary indicator "expenditures". The software is realized and tested under real conditions of IDMSS in the contours for the organizational-technical and operational management of the OBI protection. An improved architecture of IPCS is different from the existing solutions in the possibility of simultaneous optimization of sets of software and hardware tools for the examined perimeters of OBI, for both centralized and decentralized variants for processing the information. In this case, an analysis of the level of protection of OBI is performed in real time. It is proven that the use of the developed IDMSS makes it posible to significantly reduce the planned spending on an information protection system, as well as reduce the time it takes to inform decision-makers about information security incidents.

The paper presents results of the research aimed at the further development of models for the intelligent systems of recognition of cyber threats, anomalies and cyber attacks. A structural scheme of adaptive expert system (AES) of information security, capable of self-learning, is proposed, which takes into account potential errors of the third kind, which may arise and accumulate while training a system of intelligent detection of complex targeted cyber attacks and preliminary process of splitting a space of attributes of the objects of recognition. We developed a model for calculating information criterion of functional effectiveness, based on entropic and distance criteria of Kullback-Leibler in the course of clustering the attributes of objects of recognition in computer systems, which allows obtaining input fuzzy classification training matrix. A procedure for the operation of AES as an element of the system for intelligent recognition of cyber threats (SIRCT) was explored in the training mode by a priori classified training matrix that allowed us to build correct decisive rules for the recognition of cyber attacks. We designed AES "Threat Analyzer" and conducted its test research under conditions of real CoS performance at several enterprises. It was found that the proposed model of AES learning makes it possible to achieve results of the recognition of the standard classes of cyber attacks at the level from 76.5 % to 99.1 %, which is at the level of recognition effectiveness by the best hybrid neural networks and genetic algorithms.