221
IMPROVED METHOD FOR THE FORMATION OF
LINGUISTIC STANDARDS FOR
OF INTRUSION DETECTION SYSTEMS
1
AKHEMETOV BAKHYTZHAN , 2KORCHENKO ANNA,3AKHMETOVA SANZIRA ,
4
ZHUMANGALIEVA NAZYM
1
Assoc Prof., Doctor of Technical , Institute of Information and Telecommunication Technologies, Kazakh National Technical University named after K. I. Satpayev, Almaty, Kazakhstan,
2
Department of Information Technology Security, National Aviation University, Kyiv, Ukraine.
3
Institute of Information and Telecommunication Technologies, Kazakh National Technical University named after K. I. Satpayev, Almaty, Kazakhstan,
4
Institute of Information and Telecommunication Technologies, Kazakh National Technical University named after K. I. Satpayev, Almaty, Kazakhstan,
E-mail: [email protected]
,
[email protected],
[email protected],
4
ABSTRACT
Due to intensive development of digital business, malicious software and other cyber threats are becoming more common. To increase the level of security necessary special remedies that can be effective when new types of threats and allow fuzzy conditions to detect cyberattacks targeting multiple resources of information systems. Different attacking effects on related resources give rise to different sets of parametric anomalies in a heterogeneous environment. Known tuple model of the formation of a set of core components that allow to detect cyberattacks. For its effective application requires a formal approach to the formation of fuzzy (linguistic) standards. To this end a method is developed that focuses on the tasks of identifying cyberattacks on computer systems, which is based on mathematical models and methods of fuzzy logic and is implemented through six basic stages: the formation of subsets of identifiers linguistic assessments, forming the base matrix of frequencies, the formation of the derivative matrix of frequencies, the formation of fuzzy terms, the formation of the reference fuzzy numbers, visualization of linguistic standards. The method allows to improve the process of formalization of linguistic standards receive options to improve the efficiency of construction of the corresponding intrusion detection systems.
Keywords: Artificial Neural Network (ANN), Static Var Compensator (SVC), Autonomous Hybrid Power System (AHPS)
1. INTRODUCTION
1.1 Relevance
The formation of many markets and industries today it is difficult to imagine without information technologies. Due to the development of digital business and the Internet, malicious software and other cyber threats are becoming more prevalent and pervasive. In this regard, the necessary means to detect cyberattacks on various resources of
222 successful response to cyberattacks. Important in detecting anomalies, generated by cyberattacks, is the formation of fuzzy standards [2]. On this basis, the development of methods that improve the process of formalization of receiving linguistic standards of the parameters for the intrusion detection systems, there is actual scientific task.
1.2 Analysis Of Existing Research
A number of famous, quite effective developments used to solve these problems, detect cyberattacks, such as: the tuple model to form the basic component for the detection of cyberattacks [2], fuzzy approaches to intrusion detection [3]–[4] and detecting anomalies [5]; the corresponding fuzzy model [1], [6]–[7], methods [8]–[10] and intrusion detection system [11]–[13]; the sets of fuzzy rules [3]–[4], [8], [14]–[22], as well as other developments that are used for solving problems in fuzzy environment [23]. These studies demonstrated efficiency of application of mathematical apparatus of fuzzy sets, and its use to formalize the approach to identifying cyberattacks would improve the process of creating appropriate systems of detection of intrusions. It should be noted that many of the attacking effects on the resources of the information systems generate a lot of anomalies among the heterogeneous variables in a parametric environment [2].
For effective application of known models [2], [24] the formal implementation of the process of formation of fuzzy (linguistic) standards that will allow in a given linguistic variable identifies the search term [10]. On this term by using the corresponding sets of rules to determine the level of abnormal condition created by the impact of the corresponding class of cyberattacks.
1.3 Main Objective Of Research
Based on the analysis of existing research and the relevance of the task the aim of this work is to develop an improved (generalized) method of formation of linguistic standards (MFLS) for intrusion detection systems, operating in formalized fuzzy environment.
With such a method (when solving the tasks of identifying cyberattacks) can be formalized receiving process standards of the parameters for a given group of linguistic variables used to identify certain types of attacks on specific parametric heterogeneous environment in a specified time period.
2. MAINPARTOFRESEARCH
For construction of a subset of linguistic standards
Т
еij (see (13) in [2]), displaying the characteristic judgement of the expert concerning the anomalous state of the parameterP
ij we will develop an appropriate method that allows to formalize the process of obtaining standards of the parameters for the specified groups of linguistic variables for a specific environment. Improved method for the formation of linguistic standards (MFLS) is focused on solving the tasks of identifying cyberattacks on computer systems is a further development of the method of linguistic terms using statistical data [23] and is based on six stages.Stage 1 – formation of subsets of identifiers linguistic assessments. The creation of the subset
i
LE
is based on the set of all possible identifiers (ID) of linguistic evaluations (judgments) expertLE
submitted asLE
==
U
c
l l 1
{
LE }
=1
{ LE
,LE
2, …,LE }
c ,( l
=
1,c )
, (1) and that display used expert judgment to characterize the parametersP
i [2], [24] when observed in am
-dimensional parametric heterogeneous environment [2], and thec
– number of such ID.For example, when
с
=
10
according to (1) the setLE
can be represented as follows:LE
==
U
10 ll 1
{
LE }
={ LE
1,LE
2, …,LE }
10 =VS
{ LE
,LE
S,LE
A,LE
B,LE
VB,LE
Y,LE
M,O
LE
,LE
L,LE }
H ={"VS", "S", "A", "B",
"VB", "Y", "M", "O", "L", "H"}
, (2) whereLE
1=LE
VS="VS"
,LE
2=LE
S="S"
,3
LE
=LE
A="A"
,LE
4=LE
B="B"
,LE
5=LE
VB=
"VB"
,LE
6=LE
Y="Y"
,LE
7=LE
M ="M"
,8
LE
=LE
O="O"
,LE
9=LE
L="L"
andLE
10=H
LE
="H"
ID, respectively, are of such linguisticassessments (judgments) of expert as «VERY SMALL» (when
l
=
1
), «SMALL» (whenl
=
2
), «AVERAGE» (whenl
=
3
), «BIG» (whenl
=
4
), «VERY BIG» (whenl
=
5
), «YOUTH» (when=
223
=
l
8
), «LOW» (whenl
=
9
) and «HIGH» (when=
l
10
).Next, we form the subset ID of expert judgments
U
n ii 1
{
LE }
=
=
{LE
1,LE
2, …,LE }
n , (3)where
LE
i ⊆LE
,( i
=
1,n )
defined as:i
LE
=U
i m
ij j 1
{
LE }
=
=
{LE
i1,LE
i 2,…, i imLE
}
, (4)in this case
LE
ij( j
=
1,m )
i ID is a subset of the expert's judgments regarding the values of the parametersP
ij (see (8) в [2]) inm
-dimensional parametric heterogeneous environment. Taking into consideration (4) we will write formula (3) in the following form:U
n ii 1
{
LE }
=
=
U U
i m n
ij i 1 j 1
{
{
LE }}
= =
=
{{LE
11,LE
12, …,1 1m
LE
}
,{LE
21,LE
22, …, 2 2mLE
}
, …,n1
{LE
,LE
n2, …, n nmLE
}}
. (5)Thus, taking into account
LE
ij⊆LE
i, about j-th parameter the expert can apply a set from
r
j statements (linguistic estimates), displayed by a subsetij
LE
==
=
U
j
j r
ijk ij1 ij 2 ijr
k 1
{
LE } { LE ,LE ,...,LE
}
, (6)where
LE
ijk( k
=
1,r )
j –k
-th identifier of a linguistic assessment of the expert concerning a state j-the parameter wheni
-th cyberattacks in a certain environment, butr
j – number of identifiersin
LE
ij.Further, the expression (5) with (6) takes the following form:
U
n ii 1
{
LE }
=
=
U U
i m n
ij i 1 j 1
{
{
LE }}
= =
=
= = =
U U U
j i r
m n
ijk i 1 j 1 k 1
{
{
{
LE } } }
=111
{{{ LE
,LE
112, …,1
11r
LE
}
,{ LE
121,LE
122,…,
2
12 r
LE
}
, …,1
1m 1
{ LE
,1
1m 2
LE
, …,1 m1
1m r
LE
}}
,
{{ LE
211,LE
212, …,1
21r
LE
}
,{ LE
221,LE
222,…,
2
22 r
LE
}
, …,2
2 m 1
{ LE
,2
2 m 2
LE
, …,2 m2
2 m r
LE
}}
, …,{{ LE
n11,LE
n12, …,LE
n1r1}
,n21
{ LE
,LE
n 22, …,2
n 2 r
LE
}
, …,n
nm 1
{ LE
,n
nm 2
LE
, …,n mn
nm r
LE
}}}
. (7)For example, when
n
=
3
(i.e., to cyberattacks IDCA
1=CA
SN=SN
– «Scanning of ports (SN)»,2
CA
=CA
DS=DS
– «Denial of service (DS)» and3
CA
=CA
SP=SP
– «Spoofing (SP)»),=
=
1 3
m
m
2
,m
2=
3
,r
1=
5
,r
2=
r
3=
3
the expression (7) can be defined as:U
3 ii 1
{
LE }
=
=
U U
i m 3
ij i 1 j 1
{
{
LE }}
= =
=
= = =
U U U
j i r
m 3
ijk i 1 j 1 k 1
{
{
{
LE } } }
=111
{{{ LE
,LE
112,LE
113,LE
114,LE
115}
,121
{ LE
,LE
122,LE
123}}
,211
{{ LE
,LE
212,LE
213,LE
214,LE
215}
,{ LE
221,
LE
222,LE
223}
,231
{ LE
,LE
232,LE
233}}
,311
{{ LE
,LE
312,LE
313,LE
314,LE
315}
,321
{ LE
,LE
322,LE
323}}}
=SNNVC1
{{{ LE
,LE
SNNVC 2,LE
SNNVC3,LE
SNNVC4,N SN VC5
LE
}
,{ LE
SNVCA1,LE
SNVCA2,LE
SNVCA3}}
,DSNCC1
{{ LE
,LE
DSNCC2,LE
DSNCC3,LE
DSNCC4,N DS CC5
LE
}
,{ LE
DSSPR1,LE
DSSPR2,LE
DSSPR3}
,DSDВR1
{ LE
,LE
DSDВR2,LE
DSDВR3}}
,SPNCC1
{{ LE
,LE
SPNCC2,LE
SPNCC3,C SPNC 4
LE
,LE
SPNCC5}
,N S SP P А1
{ LE
,LE
SPNPSА2,LE
SPNPSА3}}}
={{{" VS", "S", "A", "B", "VB"}
,{"Y", "M", "O"}}
,{{" VS", "S", "A", "B", "VB"}
,{"L", "A", "H"}
,{"S", "A", "B"}}
,{{" VS", "S", "A", "B", "VB"}
,{"S", "A", "B"}}}
,where:
LE
111=
LE
SNNVC1=
"VS"
,LE
112=C SNNV 2
LE
="S"
,LE
113=LE
SNNVC3="A"
,LE
114=C SNNV 4
LE
="B"
,LE
115=LE
SNNVC5="VB"
and121
224 123
LE
=LE
SNVCA3="O"
– ID, respectively, aresuch linguistic experts that show the status of settings
P
11=P
SNNVC=NVC
«Numbers of Virtual channels» andP
12=P
SNVCA=
VCA
«Virtual Channel Age» in2
-dimensional parametrical sub-environment [2];211
LE
=LE
DSNCC1="VS"
,LE
212=LE
DSNCC2="S"
,LE
213=LE
DSNCC3="A"
,LE
214=LE
DSNCC4=
"B"
,LE
215=LE
DSNCC5="VB"
,LE
221=R DSSP 1
LE
="L"
,LE
222=LE
DSSPR2="A"
,LE
223=R DSSP 3
LE
="H"
andLE
231=LE
DSDВR1="S"
,232
LE
=LE
DSDВR2="A"
,LE
233=LE
DSDВR3="B"
–respectively the ID of linguistic experts, showing the status of parameters
P
21=P
DSNCC=NCC
«Number of concurrent connections to the server»,
22
P
=P
DSSPR=
SPR
«Speed of processing requestsfrom the clients» and
P
23=P
DSDВR=
DВR
«The delay between requests from the single user» in3
-dimensional parametrical sub-environment;311
LE
=LE
SPNCC1="VS"
,LE
312=LE
SPNCC2="S"
,
LE
313=LE
SPNCC3="A"
,LE
314=LE
SPNCC4="B"
,
LE
315=LE
SPNCC5="VB"
andLE
321=LE
SPNPSА1="S"
,LE
322=LE
SPNPSА2="A"
,LE
323=LE
SPNPSА3=
"B"
– ID, respectively, are such expert judgmentsthat show the status of settings
P
31==
SPNCC
P
NCC
andP
32=P
SPNPSА=
NPSА
«Number of packages with the same sender and receiver address» in
2
-dimensional parametrical sub-environment.It should be noted that the expert Express his opinions on the state of the observed actual values of various parameters in a particular environment, but it can use the same statements from the set of
LE
, displayed appropriate language identifiers. For example, ID linguistic evaluation expert"VS"
for parameters
P
11=P
SNNVC=NVC
(LE
111=
=
N SN VC1
LE
"VS"
) andP
21=P
DSNCC=NCC
(211
LE
=LE
DSNCC1="VS"
) are merely linguisticequivalents of certain values of these quantities and, in fact, some characterize their relative condition, display the appropriate experts.
Stage 2 – formation of the basic matrix of frequencies. To obtain such matrix is filled in with
the set of identifiers of the intervals
N
and a subset of these identifiersN
i, which are displayed asU
n ii 1
{
N }
=
=
{N
1,N
2, …,N }
n , (8)where
N
i⊆
N
,( i
=
1,n )
we will define asi
N
=U
i m
ij j 1
{
N }
=
=
{N
i1,N
i 2, …, i imN
}
, (9)in this case
N
ij( j
=
1,m )
i – the ID subset of intervals, for determining which linguistic expert carries out the evaluation regarding the values of the parametersP
ij (see (8) in [2]) inm
-dimensional parametric heterogeneous environment. Taking into account (9) we will write down formula (8) in the following form:U
n ii 1
{
N }
=
=
U U
i m n
ij i 1 j 1
{
{
N }}
= =
=
{{N
11,N
12, …, 1 1mN
}
,21
{N
,N
22, …, 2 2mN
}
, …,n1
{N
,N
n 2, …, n nmN
}}
. (10)Further, taking into account
N
ij ⊆N
i, about j -th parameter expert for forming the borders of their assessments may use the set ofr
j intervals, the displayed subsetij
N
==
U
j
r
ijk k 1
{
N
}
={ N
ij 1,N
ij 2, …,j
ijr
N
}
, (11)where
N
ijk( k
=
1,r )
j – identifier ofk
-th interval used for the formation of frequencies of occurrence of experts on the current state j-th parameter relativei
-th cyberattacks in a certain environment, butr
j – the number of IDs fixed intervals on which the assessment.Then the expression (10) with (11) takes the following form:
U
U U
im
n n
i ij
i 1 i 1 j 1
{
N } {
{
N }}
= = =
=
=
= = =
=
U U U
j i r
m n
ijk i 1 j 1 k 1
{
{
{
N
}}}
111
{{{ N
,N
112, …,N
11r1}
,{ N
121,N
122, …,2
12r
N
}
, …,1
1m 1
{ N
,1
1m 2
N
, …,1 m1
1m r
N
}}
,211
{{ N
,N
212, …,1
21r
N
}
,{ N
221,N
222, …,2
22r
N
}
, …,2
2m 1
{ N
,2
2m 2
N
, …,2 m2
2m r
N
}}
, …,n11
{{ N
,N
n12, …,1
n1r
N
}
,{ N
n21,N
n22, …,2
n 2r
N
}
, …,n
nm 1
{ N
,n
nm 2
N
, …,n mn
nm r
225 Based on the elements of the subsets
LE
ij andij
N
formed synthesis table of assessments (table 1), the content of which is based on the current fixation evidence (judgments, evaluations), expert, wheref
ijsq(s,q
=
1,r )
j – elements of empirical data showing the number (frequency) of the same utterances (the use of linguistic assessments of the subsetLE
ij) expert, characterizing the state of the j-th parameter onthe interval ID
N
ijq min max ijq ijq[ N
; N
]
(q
=
1,r )
j ,where
N
ijqmin andN
ijqmax respectively the lower and upper boundq
-th interval.Table 1 Generalized table of assessments
LE
ijLE
N
ijij 2
N
… …LE
ij 12
f
… …LE
ij 22
f
… ……
LE
ijs 2
f
… ……
LE
j
ijr 2
f
… …Further on the basis of generalized evidence on the elements of the subset
LE
ij (see table 1) formed the basic matrix of frequenciesij 12
f
… …=
=
ij ijsq
F
f
ij 22
f
… …ijs 2
f
… …j
ijr 2
f
… … .(1 3)
For example, if you want to build a matrix
F
ij=
j(s,q
1,r )
, which will be the basis for buildingstandards
T
ije, whenn
=
3
(i.e. cyberattacks withID
CA
1=CA
SN=SN
,CA
2=CA
DS=DS
andCA
3=
CA
SP=SP
),m
1=
m
3=
2
,m
2=
3
,r
1=
5
,=
=
2 3
r
r
3
the expression (12) can be defined as:U
U U
im
3 3
i ij
i 1 i 1 j 1
{
N } {
{
N }}
= = =
=
=
= = =
=
U U U
j i r
m 3
ijk i 1 j 1 k 1
{
{
{
N }}}
111
{{{ N
,N
112,N
113,N
114,N
115}
,121
{ N
,N
122,N
123}}
,211
{{ N
,N
212,N
213,N
214,N
215}
,221
{ N
,N
222,N
223}
,{ N
231,N
232,N
233}}
,311
{{ N
,N
312,N
313,N
314,N
315}
,321
{ N
,N
322,N
323}}}
=SNNVC1
{{{ N
,N
SNNVC2,N
SNNVC3,N
SNNVC4,SNNVC5
N
}
,{ N
SNVCA1,N
SNVCA2,N
SNVCA3}}
,DSNCC1
{{ N
,N
DSNCC2,N
DSNCC3,N
DSNCC4,DSNCC5
N
}
,{ N
DSSPR1,N
DSSPR2,N
DSSPR3}
,R DSDВ 1
{ N
,N
DSDВR2,N
DSDВR3}}
,SPNCC1
{{ N
,N
SPNCC2,N
SPNCC3,SPNCC4
N
,N
SPNCC5}
,N SP PSА1
{ N
,N
SPNPSА2,N
SPNPSА3}}}
. (14) For example, according to (14) whenn
=
1
, (=
i
3
i.e., to cyberattacks with IDCA
3=CA
SP=SP
),j
=
2
,r
j=
3
для{ N
321,N
322,N
323}
on the basis of the generalized tables (see table 1) build the current table of assessments (table 2) on the elements of the subsetLE
ijk=
LE
32k=
N SP PSАk
LE
( r
2=
3
,k
=
1,3 )
, whereLE
321=
=
NP SP SА1LE
"S"
,LE
322=
LE
SPNPSА2=
"A"
,=
323LE
LE
SPNPSА3=
"B"
andN
ijk=
N
32k=
SPNPSАk
N
, butN
ij1=
N
321=N
SPNPSА1NPS min SP А1
[ N
;
N
SPmaxNPSА1]
<=>
[0; 10],N
ij 2=
N
322=SPNPSА2
N
[ N
SPminNPSА2;
N
SPmaxNPSА2]
<=>
[11;100],
N
ij 3=
N
323=N
SPNPSА3 minNPSSP А3
[ N
;
NPSА max SP 3
[image:5.612.88.530.104.746.2]N
]
<=>
[101; 1000].226 The current table estimates for
LE
3232
LE
=SP
LE
32 SPNPSА
N
=
N
SP 1
N
N
SP 2N
SP 3" S "
3 1 0
" A"
1 4 2" B"
0 2 3Then, when
s,q
=
1,3
according to expression (13) using the data of table 2, we generate the matrix of frequencies, i.e.=
=
=
=
32 SPNPSА 32sq SPNPSАsq
F
F
f
f
f
3212
f
f
3213f
3222
f
f
3223f
3232
f
f
3233=
Stage 3 – formation of the derivative matrix of frequencies. To implement this step, you create a vector of sums (
VS
ij) the appropriate columns of the frequency matrix of (13), i.e.=
ijVS
vs
ijq=
=
j
ij1 ij 2 ijq ijr
vs ,vs ,...,vs ,...,vs
= = = =
=
∑
∑
∑
∑
j j j j j
r r r r
ijs1 ijs2 ijsq ijsr
s 1 s 1 s 1 s 1
f
,
f
,...,
f
,...,
f
=
=
∑
U
j j
r r
ijsq s 1 q 1
f
,(s,q
=
1,r )
j , (15)where
f
ijsq − are the elements of the matrixF
ij.Further by the member of
VS
ij defined a maximum value according to the formula=
=
∨
j
r
ij q 1 ijq
vsm
vs
, (16)which is used to form the derivative matrix of frequencies
=
=
' '
ij ijsq ij ijq ijsq
F
f
( vsm /vs ) f
<=>
=
=
'
ij ij ijq ij
F
( vsm /vs )F
' ij 12
f
… …' ij 22
f
… …' ijs 2
f
… …j
' ijr 2
f
… …. (17) Consider the formation of
F
ij' on a concrete example. To do this, wheni
=
3
,j
=
2
we will create a vector of sumsVS
ij=
VS
32 the appropriate columns of the frequency matrix of (13) using expression (15), i.e.=
32VS
vs
32q=
vs
321,vs
322,vs
323=
=
=
∑
U
3 3 32sqs 1 q 1
f
<=>
VS
SP PSАN=
vs
SPNPSАq=
=
NPSА NP
SP 1 SP SА2 SPNPSА3
vs
,vs
,vs
= =
=
∑
U
3 3 S NPS 1А P sq s
q 1
f
4 , 7 , 5
,(q
=
1, 3 )
.Then from
VS
32=
VS
SPNP АS by the formula (16) we will define a maximum element=
=
∨
=
3
32 q 1 32 q
vsm
vs
vs
321∨
vs
322∨
vs
323=
∨ ∨
=
4
7
5
vsm
SPNPSА=
7
,and the derivative matrix of frequencies
=
=
' '
32 32sq
F
f
( vsm /vs
32 32q) f
32sq=
F
SPNPSА'we will get according to the expression (17)
=
=
NPSА NP
'
SP SP SА SPNPSАq SPNPSА
F
( vsm
/vs
)F
5,3 1 0
1,8 4 2,8
0 2 4,2 .
Stage 4 – formation of fuzzy terms. The construction of subsets of the fuzzy terms
T
i is based on the set of all possible termsT
, showing the specific status of the corresponding parameters fromP
i inm
i-dimensional parametrical sub-environment [2], i.e.U
n ii 1
{
T }
=
=
{T
1,T
2, …,T }
n , (18)where
T
i ⊆T
,( i
=
1,n )
, andi
T
=U
i m
ij j 1
{
T }
=
=
{Т
i1,Т
i 2, …, i im227 thus
Т
ij( j
=
1,m )
i is a fuzzy subset of terms relative to the values of the parameters is a fuzzy subset of terms relative to the values of the parametersP
ij (see (8) in [2]). Taking into account (19) formula (18) we will write in the following form:U
n ii 1
{
T }
=
=
U U
i m n
ij i 1 j 1
{
{
T }}
= =
=
11
{{T
,T
12, …, 1 1mT
}
,{T
21,T
22, …, 2 2mT
}
,…,
{T
n1,T
n 2, …, n nmT
}}
,( j
=
1,m )
i . (20)Thus, taking into account
T
ij⊆T
i and (20), a subset of the fuzzy terms defined as:ij
T
==
U
j
r
ij s s 1
{
~
T }
={ Т
~
ij1,~
Т
ij 2, …,j
ijr
Т
}
~
, (21)where
Т
ijs~
( s
=
1,r )
j – are fuzzy terms, andr
j –the number of members in
T
ij.Further, the expression (20) with (21) takes the following form:
U
n ii 1
{
T }
=
=
U U
i m n
ij i 1 j 1
{
{
T }}
= =
=
= = =
U U U
j i r
m n
ijs i 1 j 1 s 1
{
{
{
T } } }
~
=111
{{{ T
~
,~
T
112, …,~
T
11r1}
,{ T
~
121,~
T
122, …, 212 r
T
}
~
, …,{ T
~
1m 11 ,~
T
1m 21 , …,~
T
1m r1 m1}}
,{{ T
~
211,212
T
~
, …,~
T
21r1}
,{ T
~
221,~
T
222, …,~
T
22 r2}
, …, 22 m 1
{ T
~
,~
T
2 m 22 , …,~
T
2m r2 m2}}
, …,{{ T
~
n11,~
T
n12,…,
1
n1r
T
}
~
,{ T
~
n 21,~
T
n22, …,~
T
n 2 r2}
, …,{ T
~
nm 1n , nnm 2
T
~
, …,~
T
nm rn mn}}}
. (22)Next, it needs to generate the values displayed in the component
Т
ijs~
, what for the followingtransformations are used. On
F
ij' matrix elements according to expression (23) the vector of maxima is under construction=
=
ij ijq
FM
fm
=
j
ij1 ij 2 ijq ijr
fm , fm ,..., fm ,..., fm
= = = =
=
∨ ∨
j j∨
j∨
jj
r r r r
' ' ' '
ijs1 ijs2 ijsq ijsr
s 1
f
,
s 1f
,...,
s 1f
,...,
s 1f
= =
∨
U
j j r
r ' ijsq s 1 q 1
f
,(s,q
=
1,r )
j . (23)Based on
FM
ij we generate the matrix of membership functions=
µ
=
ij ijsq
M
µ
ij12 … …µ
ij 22 … ……
µ
ijs 2 … ……
µ
j
ijr 2 … …
, (24) each element of which is given by the expression
=
µ
'ijsq
f
ijsq/fm
ijs(s,q
=
1,r )
j . Using (24), wedefine the fuzzy sets of terms (numbers)
Т
ijs~
onthe basis of the expression
ijs
Т
~
=U
=µ
=
j
r
ijsq ijsq q 1
{
/ x
}
{
µ
ijs1/ x
ijs1,
µ
ijs2/ x
ijs2,...,
µ
j j
ijsr
/ x
ijsr}
,(q
=
1,r )
j , (25)where
=
j
max max ijsq ijq ij r
x
N
/N
(q
=
1,r )
j . (26)Note that the fuzzy number (FN)
Т
ijs~
(s
=
1,r )
jaccordingly interpreting linguistic utterances of experts
LE
ijk( k
=
1,r )
j , the display elements ofthe subset
LE
ij⊆LE
(see (7)).Show the process of formation
T
ij of a specificexample, when
n
=
3
(i.e. for cyberattacks IDCA
1 =CA
SN=SN
,CA
2=CA
DS=DS
andCA
3=CA
SP =SP
),m
1=
m
3=
2
,m
2=
3
,r
1=
5
,=
=
2 3
r
r
3
the expression (22) can be defined as:U
3 ii 1
{
T }
=
=
U U
i m 3
ij i 1 j 1
{
{
T }}
= =
=
= = =
U U U
j i r
m 3
ijs i 1 j 1 s 1
{
{
{
T } } }
~
=111
{{{ T
~
,~
T
112,~
T
113,~
T
114,~
T
115}
, 121{ T
~
,~
T
122,~
T
123}}
, 211{{ T
~
,~
T
212,~
T
213,~
T
214,~
T
215}
, 221{ T
~
,~
T
222,~
T
223}
,{ T
~
231,~
T
232,~
T
233}}
, 311{{ T
228 321
{ T
~
,~
T
322,~
T
323}}}
= 11{{{VS
~
,~
S
11,~
A
11,~
B
11,VB }
~
11 , 12{ Y
~
,~
M
12,~
O }}
12 , 21{{VS
~
,~
S
21,~
A
21,~
B
21,VB }
~
21 , 22{ L
~
,~
A
22,~
H }
22 ,{ S
~
23,~
A
23,~
B }}
23 , 31{{VS
~
,~
S
31,~
A
31,~
B
31,VB }
~
31 , 32{ S
~
,~
A
32,~
B }}}
32 =SNNVC1
{{{ T
~
,~
T
SNNVC2,~
T
SNNVC3,~
T
SNNVC4, NVSN C5
T
}
~
,{ T
~
SNVCA1,~
T
SNVCA2,~
T
SNVCA3}}
, DSNCC1{{ T
~
,~
T
DSNCC2,~
T
DSNCC 3,~
T
DSNCC 4, DSNC 5CT
}
~
,{ T
~
DSSPR1,~
T
DSSPR2,~
T
DSSP 3R}
, DSDВR1{ T
~
,~
T
DSDВR2,~
T
DSDВR3}}
, SPNCC1{{ T
~
,~
T
SPNCC2,~
T
SPNCC 3,~
T
SPNCC 4, SPNC 5CT
}
~
,{ T
~
SPNPSА1,~
T
SPNPSА2,~
T
SPNPSА3}}}
= SNNVC{{{VS
~
,~
S
SNNVC,~
A
SNNVC,~
B
SNNVC, N CSN V
VB
}
~
,{ Y
~
SNVCA,~
M
SNVCA,~
O
SNVCA}}
, DSNCC{{VS
~
,~
S
DSNCC,~
A
DSNCC,~
B
DSNCC, DSNCCVB
}
~
,{ L
~
DSSPR,~
A
DSSPR,H
~
DSSPR}
,{ S
~
DSDВR, DSDВRA
~
,~
B
DSDВR}}
, SPNCC{{VS
~
,~
S
SPNCC,~
A
SPNCC, SPNCCB
~
,VB
~
SPNCC}
, SPNPSА{ S
~
,~
A
SPNPSА,~
B
SPNPSА}}}
. (27) According to (27) wheni
=
3
,j
=
2
,r
j=
3
for321
{ T
~
,~
T
322,~
T
323}
we will formT
32⊆T
, i.e.:32
T
==
U
3 32 ss 1
{
T
}
~
={ T
~
321,~
T
322,~
T
323}
=SPNPSА1
{ T
~
,~
T
SPNPSА2,~
T
SPNPS 3А}
= 32{ S
~
,~
A
32,~
B }
32 ,(s
=
1,3 )
,where
~
Т
321=~
T
SPNPSА1=~
S
32,~
T
322=~
T
SPNPSА2=32
A
~
and~
T
323=~
T
SPNPSА3=~
B
32 respectively are FN 32S
~
,~
A
32 and~
B
32, interpreting statements of the expert that are displayed byLE
SPNPSА1="S"
,N SP PSА2
LE
="A"
andLE
SPNPSА3="B"
.Further on the basis of expression (23) construct the vector of maxima on the respective lines '
=
32
F
' SPNPSА
F
i.e.=
=
SPNPSА SPNPSАs
FM
fm
=
NPSА NP
SP 1 SP SА2 SPNPSА3
fm
, fm
, fm
5 ,3; 4 ; 4 ,2
.Based on
FM
SPNPSА by the expression (24) we will form a matrix of membership functionsА SPNPS
M
thus obtaining:=
SPNPSА
M
µ
SPNPSАsq=
1 0,2 0
0,5 1 0,7
0 0,5 1 ,
where
µ
SPNPSАsq=
'SPNPSАsq SPNPSАs
f
/fm
. On thebasis of the calculated according to the expression (24)
µ
SPNPSА sq(s,q
=
1,3 )
and to the expression(26)
x
SPNPSА sq we will define sets of fuzzy termsА SPNPS
Т
~
by the formula (25), i.e.32 s
Т
~
={
µ
32s1/ x
32s1,
µ
32s2/ x
32s2,
µ
32s3/ x
32s3}
<=>
~
Т
SPNPSАs={
µ
SPNPSАs1/ x
SPNPSАs1,
µ
SPNPSАs2/ x
SPNPSАs2,
µ
SPNPSАs3/
x
SPNPSАs3}
,=
(s
1,3 )
,where according to the expression (26)
x
SPNPSАsq=
j
max ma x
SPNPSАq SPNPS rА
N
/ N
,(q
=
1,3 )
or=
=
U
3 SP sqq 1 NPSА
{
x
}
{ 0,01; 0,1; 1}
.Thus, these members of the subset
T
32 (numeric form) are respectively display the members of the subsetLE
32 (7) (linguistic form) and are presented in the following form:321
Т
~
=~
T
SPNPSА1=~
S
32={ 1/0,01;
0,2/0,1;0/1}
, 322T
~
=~
T
SPNPSА2=~
A
32={ 0,5/0,01;
1/0,1;0,7/1}
,323
T
~
=~
T
SPNPSА3=~
B
32={ 0/0,01;
0,5/0,1;0/1}
.Stage 5 – formation of reference FN. To implement this step we use the fuzzy subset (linguistic) reference standards
