An approach to modeling the decision support process of the security event and incident management based on Markov chains

摘要

An approach to the specification of the dynamics of changes in the values of quality indicators, which characterize the decision support process for security event and incident management, is proposed. The approach is based on analyzing the processes of cyber attack detection and prevention and analyzing the decision support processes for managing the structure, parameters and work modes of detection and prevention systems. It also uses controlled Markov chains in the form of difference stochastic equations. The considered mathematical representation of the state change dynamics allows one to formalize and structure the specification of this type process taking into account its requirements for operativeness (timeliness), validity (veracity), secrecy and resource costs.