Захист корпоративних мереж від атак з використанням контент-аналізу глобального інформаційного простору

Abstract

Urgency of the research. Further improvement of the security corporate networks in the conditions of massive influence of computer attacks requires an increase in the probability of detection of new computer attacks and a decrease in the recognition time for the signs of known attacks. Target setting. Analysis of the texts of the global information space reduces the time of detection of possible threats. Actual scientific researches and issues analysis. Recent publications about systems of defense from attacks and use of text analysis in detecting threats were considered. Uninvestigated parts of general matters defining. It is necessary to improve the methods of working out the data sets of the body of network packets, content of Internet pages, information of mass media and social networks, which in turn raises the problem of semantic and syntactic processing of natural language texts. The research objective. The aim of the paper is organization collective protection of corporate networks via the introduction of threat monitoring systems, active intelligence activities in the global information space in order to search collect and analyze data about attacks, abnormal behavior, and content of Internet resources. The statement of basic materials. The requirements of security systems to reduce the time of a threat detection lead to the need for active intelligence assessment aimed at continuous monitoring of the surrounding cyberspace that consists of a variety of individual users and organizations’ computer networks. The purpose of such monitoring is to determine the characteristics, interests, features of the security policy of a particular corporate network in the global information space. In this context, particular importance attaches to the analysis of text information from both fully and partially open digital sources. A rational solution to this task is the establishment of threat monitoring centers aimed at the organization of collective protection for corporate networks related to them. Conclusions. The proposed method of protection allows both to detect cyber threats in the global information space and to customize their own corporate network security systems in accordance with their characteristic threat vectors.