Scientific Journal of KubSAU

The work is devoted to searching efficient detection methods of anomalous state in data networks. There is a structure of modern informational attacks detecting system. There are short review and analysis of information system network security facilities. Two main technologies of attack detection are described: anomaly detection and misuse detection. It is shown that every detection of anomalies is based on assumption that anomalous behavior is deflection from normal profile of behavior. It is hard to implement this technology, although there is some progress when expert system, fuzzy logic and so on are used for this purpose. Action patterns or symbols assets which describe anomaly activity are used as attack signature in misuse detection method. Author offers to use benefits of both methods for solving the problem

In this article we study connection between frequency characteristics of oil filter and lubricant system condition of internal combustion engine. Method is suggested, it allows to trace changes of technical condition of oil filter, engine oil, engine and to estimate a residual resource of working capacity up to maintenance

The article is devoted to creation of intelligent management system of complex data-processing network. This is caused by the fact that modern telecommunication hardware generates growing amount of statistic information. Expert system is offered to be used in management of networks for the purpose of information security

Different stages of designing architecture of detection systems and opposition to network anomalies are analyzed in this article. It is pointed that common classification can be to determine state of network: “normal”, “critical”, “faulted”. Bases for building architecture of detection and removing anomalies are offered

The article is devoted to the expert systems technology using to monitor the correct operation of the software and databases. It is noted that the main issues of security management in critical information systems is a process of observation and collection of information in a computing environment. Observation results should be evaluated and processed by an expert on security and then recorded in the database of expert systems. One of the possible options for security management of distributed computing network - creating a security machine. It will ensure: minimum response time to external perturbations; the accuracy of the audit protected by S-interface and independent decision-making process of the state of the controlled elements of information systems. After that, the agent is completely worn out; it is destroyed and replaced by a new one. This aging mechanism protects agent from analyzing and from external attacks