Using statistical traffic analysis to calculate the confidential means of information transmission

Abstract

The article considers the modeling of security problems in the Internet as stochastic systems. This allows you to find flaws in existing security systems and offer new solutions. Studying the vulnerabilities of existing security tools can prevent cyber-attacks from taking advantage of weak systems. New, flexible and adaptive security schemes are necessary for emerging security threats elimination. A hybrid network security scheme, including intrusion detection systems and baits, scattered throughout the network is proposed. This combines the advantages of two security technologies. Honeypot is an activity-based network security system that can be a logical addition to the passive detection policies used by the IDS. This integration forces us to balance the safety indicators compared to costs, planning the operation of the device for the proposed system. Formulation of planning problems as a decentralized partially observable Markov decision-making process (DEC-POMDP) allows to make decisions in a distributed manner on each device without the need of centralized management.

Keywords

• security in the system, intrusion detection system, traffic analysis.