Existence of the need to assess the quality of computer networks security requires the development of a formalized evaluation method. One of the elements of such method is the model of threats to information system. In the article it is described a model of threats to integrity of information system exposed as a 3-level attributed metagraph. Threat model includes the threats on software, operating system and network layers. The model is used as part of the methodology for assessing the quality of computer network security.

This article highlights the issue of identifying information security threats to computer networks. The aim of the study is to increase the number of identified threats. Firstly, it was carried out the analysis of computer network models used to identify threats, as well as in approaches to building computer network threat models. The shortcomings that need to be corrected are highlighted. On the basis of the mathematical apparatus of attributive metagraphs, a computer network model is developed that allows to describe the software components of computer networks and all possible connections between them. On the basis of elementary operations on metagraphs, a model of threats to the security of computer network software is developed, which allows compiling lists of threats to the integrity and confidentiality of computer network software. These lists include more threats in comparison with the considered analogues.

The paper discusses methods for constructing threat models of information systems and computer networks. The disadvantages of existing approaches are highlighted. The authors propose an approach to building a computer network model, as well as describing threats to information and the system. The proposed approach takes into account the identified shortcomings of existing solutions and is aimed at reducing the impact of the subjective opinion of an expert when compiling lists of threats.

The research object of this article is network-based and host-based intrusion detection systems. The aim of the study is to obtain an overview of intrusion detection systems, as well as to build a constructive version of a virtual laboratory bench intended for teaching students (studying the test characteristics of intrusion detection systems). The article provides a brief reference on intrusion detection systems, taking into account the classification by the method of monitoring and the technology of detecting attacks. Today, intrusion detection system is a necessary element of a comprehensive network protection system for both small and large organizations. They improve network security by protecting against external and internal intruders. Therefore, the need to acquire skills in installing, configuring and administering intrusion detection systems is an important part of training information security specialists, which necessitates continuous updating and modernization of training tools. In this paper, we propose a virtual laboratory bench designed to study intrusion detection systems. Its architecture and functioning parameters are described. In order to select an intrusion detection system for a virtual laboratory bench, a comparative analysis of free and commercial intrusion detection systems on the market was carried out. Network-based and host-based intrusion detection systems were considered separately. For both types, their advantages and disadvantages are described. As a result, the functions and operation mechanism are described for the intrusion detection system selected based on the analysis results. In addition, examples of custom rules for handling security events are discussed.