Cybersecurity: Education, Science, Technique

29-44

Authors: Andrii Halchenko, Sergiy Choporov

The deniable encryption algorithms productivity increasing is investigated in this paper. This investigation is relevant because of effective schemes for information and its users protection. But these algorithms is very complex and lumped. It really affects them. That's why deniable encryption algorithms have not been widespread in data processing and information security systems. The execution time reducing methods and tools exploration is the main goal of this work. The divide and conquer method has been discussed and investigated in this paper. It has been implemented into the data processing system of the deniable encryption algorithms. Nothing modifies have been implemented into the base algorithm. It allows to make it universal and apply to other deniable encryption algorithms. The series of experiments have been completed by authors to verify the hypothesis. The base deniable encryption algorithm discussing is the first stage of investigation. Its vulnerabilities have been found and investigated. Another algorithm is based on the divide and conquer method applying. It has been implemented into the modified data processing system. The both algorithms efficiency has been investigated by the experiments with the real with public and secret information files. The experiments have been completed on the prepared equipment. This equipment simulates the user's workplace with real hardware and software. According to the results the deniable encryption algorithms productivity has been reached by the divide and rule method. Also the method has been verified by the different size encryption keys. The base deniable encryption algorithms have not been modified. The results have been compared with other authors' investigations. In the end authors' hypothesis has been proved. But some restrictions of this results reaching have been set by the authors.

54-66

Authors: Andrii Karpenko, Tetiana Bondarenko, Viacheslav Ovsiannikov, Valerii Martyniuk

The problem of information security in wireless sensor networks is considered in this paper. An analysis of existing recommendations for information security in wireless sensor networks. It was found that one of the key problems of information security is the hardware limitations of the sensor nodes of the network. It is substantiated that the use of more complex cryptographic protection mechanisms will increase the load on the network. Safety requirements and their description are given. The main groups and types of information security threats in wireless sensor networks are considered. The classification of attacks and protection of wireless sensor networks according to the OSI model is presented. The existing solutions for information security are considered and analyzed. The shortcomings and vulnerabilities of the considered solutions are revealed. The method of public key cryptography is considered, the main advantages and disadvantages of this method are revealed. The analysis and comparison of ECC and RSA encryption methods are carried out. It is substantiated that the use of ECC in wireless sensor networks is more efficient than RSA. The method of cryptography with a symmetric key is considered, the main advantages and disadvantages of this method are indicated. It was found that cryptographic methods using a symmetric key are more priority for use in wireless sensor networks. Cryptographic key management protocols in wireless sensor networks are considered. The classification of key management protocols is given. Secure routing protocols are considered. The classification of secure routing protocols is given. Methods of secure data aggregation are considered. Contradictions between the requirements for confidentiality and data aggregation have been revealed. The method of intrusion detection is considered, the main advantages and disadvantages of this method are revealed. The results of this work should be used in the design of wireless sensor networks.

75-87

Authors: Anna Ilyenko , Sergii Ilyenko , Oleksandr Vertypolokh

This article discusses further ways to protect traffic from DPI systems. The possibilities of using network protocols and application of DPI systems are investigated in the article. The analysis of the problem made it possible to identify vulnerabilities in the DNS protocol, which is based on the UDP protocol. These vulnerabilities include spoofing, interception, and traffic tethering. Also on the basis of the analysis of methods of protection of DNS traffic from interference, the authors substantiate and define the following: 1) all DNS queries are transmitted in the open; 2) existing approaches to traffic protection do not use encryption and, consequently, do not ensure the confidentiality of information; 3) there is only confirmation of the authenticity of the records. The authors have created a summary table, which identifies reliable methods of protecting DNS traffic. The authors propose the development of a full-fledged local proxy server to provide DNS traffic that can access trusted public DNS resolvers using doh and dot protocols. To understand the principles of protocol interaction, we developed our own local implementation of the main components of the network, which are most often dealt with by network users, namely: 1) web server; 2) DNS server; 3) server providing cryptographic protection and hiding open requests. The practical value of the obtained results lies in the software implementation of methods to protect traffic from DPI systems in Visual Studio Code by using the Python 3.8 programming language, which allows to provide cryptographic protection of traffic. The proposed solution of the local proxying server can be improved in the future by introducing local caching with the addition of the ability to create rules for certain domains and their subdomains. The implemented test doh server can be deployed on a trusted dedicated server outside of possible filter equipment installation points. This implementation will allow you to fully control your own traffic for resolving domain names. The authors further plan a number of scientific and technical solutions to develop and implement effective methods, tools to meet the requirements, principles and approaches to cyber security and traffic protection from interference by DPI systems in experimental computer systems and networks.

98-112

Authors: Iryna Litvinchuk, Ruslan Korchomnyi , Nataliia Korshun , Maksym Vorokhob

The article is devoted to the assessment of information security risks in automated systems of class "1". An adapted approach to the assessment of information security risks in such automated systems using the Methodology and requirements of the standards of GSTU SUIB 1.0 / ISO / IEC 27001: 2010 and GSTU SUIB 2.0 / ISO / IEC 27002: 2010 is proposed. The efficiency and methods of implementation of the approach are proved on the example of consideration of real threats and vulnerabilities of class 1 automated systems. The main requirement for the creation of information security management system in the organization is risk assessment and identification of threats to information resources that are processed in information and telecommunications systems and speakers. The basic standards on information security in Ukraine are considered, which give general recommendations for the construction and assessment of information security risks within the ISMS. The most common methods and methodologies for assessing information security risks of international standard are analyzed, their advantages and disadvantages are identified. The order of carrying out of works on an estimation of risks of information security of the AS of a class "1" is defined. The vulnerabilities considered by the expert according to the standard ISO/IEC 27002:2005 and the Methodology are given. A conditional scale for determining the impact on the implementation of threats to integrity, accessibility, observation is given. Measures and means of counteracting the emergence of threats are proposed. This approach can be used both for direct information risk assessment and for educational purposes. It allows to get the final result regardless of the experience and qualifications of the specialist who conducts risk assessment, with the subsequent implementation and improvement of the existing risk management system in the organization.

123-134

Authors: Anna Ilyenko , Sergii Ilyenko , Olena Prokopenko

Today cryptographic systems provide secure communication between users. In the present paper we describe existing cryptographic systems such as: systems based on the complexity of factorization of a large integer (RSA); systems based on the complexity of solving a discrete logarithm in finite Galois field (eigamal, DSA); systems based on the complexity of solving a discrete logarithm in a group of points of an elliptic curve (ECC); lattice-based systems (NTRU). Authors focus their attention on ntruencrypt encryption and decryption algorithm. The ntruencrypt public key cryptosystem guarantees the integrity and confidentiality of information when transmitting, storing and processing information messages in modern computer systems and networks. The conducted studies of public key cryptosystem made it possible to determine the way of the improve ntruencrypt public key cryptosystem. In this paper, we present improved ntruencrypt public key cryptosystem which is based on the correct selection of parameters p and q. The authors concluded that, to reduce the difference between the length of ciphertext and plaintext, it is necessary to take p and q closer to each other. At the same time it is necessary to consider that at too close values p and q the cryptosystem can be weakened. The main difference between the proposed schemes was the reducing the size of ciphertext which can minimizes the time for software encryption and decryption operations. As a result is a software implementation of the procedure for the encryption and decryption of the improve ntruencrypt public key cryptosystem using a programming language Ruby 1.9.3 was obtained using the cryptolib library. Improved algorithm will be a perfect tool for ensuring the confidentiality of information, using “cloud” computing, because protecting information from unauthorized access is one of the most pressing problems. The authors further plan a number of scientific and technical solutions to develop and implement effective methods, tools to meet the requirements, principles and approaches to cyber security and cryptosystems for provide integrity and confidentiality of information in experimental computer systems and networks.

144-157

Authors: Oleh Harasymchuk, Ivan Opirskyy, Yaroslav Sovyn, Ivan Tyshyk, Yevhenij Shtefaniuk

This paper is devoted to the consideration of information security problems in distance learning systems (DLS), which are becoming widespread in the modern world of educational services, as one of the most effective and promising training systems. The basic information about DLS that exist in the Ukrainian and foreign educational markets is given. The general principle of application of such training, the main functional components and objects of interaction within the framework of DLS are considered. The basic problems of information protection in modern distance learning systems and threats from the point of view of information security for such systems are analyzed in detail, the main goals that an attacker may pursue while carrying out attacks on DLS and vulnerabilities due to which he carries out these attacks are listed. Threats and destabilizing effects of accidental nature are also mentioned. The most common DLS's are compared according to such key parameters as threats of corrupt registration and authentication, threats of reliability of knowledge control results and threats of malicious software implementation. The main focus is on the approaches to the protection of DLS from threats of user substitution (both during the authorization and for an authorized user), threats of the usage of software bots and scripts (by applying the method of protection against the use of scripts based on hidden elements and the method of protection based on behavioral analysis), and also threats to the usage of lectures, electronic reference books and other third-party teaching materials. The mechanism of protection against threats to the reliability of knowledge control results is proposed, which describes actions of the DLS user and the server at the following stages: registration, login, user in the process of filling in the questionnaire, user completed the questionnaire, user starts the test / task and completed testing. This algorithm can be used in any distance learning system to protect from threats to the authenticity of knowledge, and its novelty consists in the usage of methods of user authentication and limiting the functionality available to those users.

169-183

Authors: Serhii Tolіupa , Oleksandr Pliushch , Ivan Parkhomenko

Systems for detecting network intrusions and detecting signs of attacks on information systems have long been used as one of the necessary lines of defense of information systems. Today, intrusion and attack detection systems are usually software or hardware-software solutions that automate the process of monitoring events occurring in an information system or network, as well as independently analyze these events in search of signs of security problems. As the number of different types and ways of organizing unauthorized intrusions into foreign networks has increased significantly in recent years, attack detection systems (ATS) have become a necessary component of the security infrastructure of most organizations. The article proposes a software prototype of a network attack detection system based on selected methods of data mining and neural network structures. The conducted experimental researches confirm efficiency of the created model of detection for protection of an information network. Experiments with a software prototype showed high quality detection of network attacks based on neural network structures and methods of intelligent data distribution. The state of protection of information systems to counter cyber attacks is analyzed, which made it possible to draw conclusions that to ensure the security of cyberspace it is necessary to implement a set of systems and protection mechanisms, namely systems: delimitation of user access; firewall; cryptographic protection of information; virtual private networks; anti-virus protection of ITS elements; detection and prevention of intrusions; authentication, authorization and audit; data loss prevention; security and event management; security management.