Development of methodology for modeling the interaction of antagonistic agents in cybersecurity systems

A multicriterial analysis of the efficiency of conservative information security systems

The development of the social aspect of the world community is closely related to the expansion of the range of digital services in cyberspace. A special place in which social networks occupy. The world's leading states are conducting information operations in this environment to achieve geopolitical goals. Such processes are reflected in real social and political life. This makes it possible to influence not only the social groups of society, but also to ensure manipulation in political "games" in the conduct of hybrid wars. The simultaneous interaction of social factors, influencing factors, the presence of communities in social networks forms a full-fledged socio-cyber-physical system capable of integrating real and virtual interactions to manage regional communities. The article proposes a method for predicting the assessment of social mutual influence between “formal” and “informal” leaders and regional societies. The proposed models make it possible to form not only a forecast of the influence of agents, but also the interaction of various agents, taking into account their formal and informal influences, the use of administrative resources, political moods of the regional society. This approach allows dynamic modeling based on impact and relationship analysis. The presented results of simulation modeling do not contradict the results of opinion polls and make it possible to form a set of measures that can be aimed at overcoming the negative impact on the regional society of both individual “leaders” and political parties. Analysis of the simulation results allows to increase both the political and social stability of the regional society, helps to prevent conflict moods and contradictions.

The object of the study is a corporate network with a dynamic structure and centralized management. The subject of the research is the processes of ensuring the protection of information resources in the corporate network. The goal is to develop a method of protecting information in the corporate network. The development is based on the Zero Trust Security strategy, according to which access to the network is allowed only after verification and identification of information. The task is to develop an effective method of protecting information resources and managing cyber security in the corporate network, taking into account the complex aspects of malicious influence. The following results were obtained. It is shown that the complex, diverse presentation of information in the network requires a comprehensive approach with the division of mixed content of information into segments according to the target orientation. Based on CISA's (Cybersecurity and Infrastructure Security Agency) Zero Trust Maturity Model, a method of targeted traffic segmentation is proposed. It allows detailed analysis of the interaction between applications, users and corporate network infrastructure, which increases the level of complex threats detection by 15 %. A method of protecting information resources of a socio-cyber-physical system is proposed, which, based on the principle of the Zero Trust Security strategy, improves the monitoring and management of cyber security of information resources by taking into account social aspects. This allows to detect and respond to threats in real time and adapt security policies according to the dynamics of user behavior and general security conditions. Integrating analytical methods and modern technologies into a security strategy creates a foundation for adaptive and resilient cyber defense.

During this investigation, a structural model of the system for evaluating the cyber security of cloud services of information infrastructure objects will demonstrate, which is intended to be used for the evaluation of all public cloud services. A structural model of the cyber security evaluation system of cloud services has been developed, consisting of 11 module evaluation parameters, namely: network, data storage, server, virtualization, operating system, containerization, continuous operation, applications and data processing. For the developed a structural model of the evaluation system, all the modules involved in the evaluation of the used cloud service are presented, as well as the formulas for calculating each of the 1 evaluation parameters involved in a successful system are presented. For the developed a structural model of the evaluation system, a schematic image has been developed that demonstrates the dependence of all system components and the used evaluation parameters of cloud services, as well as interaction with the database, which places all information about questions, answers, recommendations, and evaluations made by the auditor, is presented. In addition, the schematic image shows the process of recording the evaluation results to the database. The visualization of the results of the conducted assessment is presented by generating a separate web page, the data for which is taken from the database tables containing the results of the conducted assessment and a recommendation is presented regarding the possibility of using or not using the cloud service in the productive environment of the company based on the points obtained from the assessment results 11 modules. Additionally, it is possible to download the evaluation results into a separate report that can be presented to the company's management for a final decision. So, this work describes the modules and databases used to build a structured model of the evaluation system, as well as the algorithm for evaluating the cyber security of a cloud service and providing a final conclusion regarding the recommendation to use or not use the evaluated cloud service.

In this paper, we present an agent-based model of a controlled detonation system for dynamic sandbox analysis of suspicious software. Instead of treating the sandbox as a passive observer, the model places an AI operator inside the analysis loop and allows it to perform adaptive GUI interactions in a plausible, isolated execution environment. The controlled detonation process is formulated as a partially observable Markov decision process (POMDP), while the proposed proof-of-concept architecture combines initial profiling, VM preparation, multi-layer telemetry, and an RL policy with visual perception and temporal memory. Evaluation in a controlled emulation setting on 180 malware samples from three threat classes shows higher Activity Rates and Coverage, and shorter Time-to-Reveal than passive and fixed scripted baselines. These results support the feasibility of adaptive interactions as a promising direction for sandbox analysis, while broader external validation, matched comparisons with prior systems, and component-wise ablation remain future work.