Threat modeling expert system: reasons for development, method and implementation troubles

Abstract

The assessment of information security threats is necessary to develop a threat model. Also, the results of the assessment are needed to choose information protection measures. This paper describes the importance of assessing information security threats in the process of developing an information security system. A comparison of the new methodological document of the FSTEC of Russia (February 2021) with the previously valid methodological document showed an increase in the complexity of threat analysis. In this regard, the paper identifies the need to automate the process of assessing information security threats. It describes the factors that lead to an increase in the complexity of the procedure.The dynamics of the growth of the number of information security threats in the Threat Database of the FSTEC of Russia during its existence is brought into sharp focus. The legal justification of the possibility of automating the analysis of information security threats is indicated.The method of expert systems is selected and justified as a method of automating the process of assessing security threats. The paper provides advantages and disadvantages of the method of expert systems in relation to this problem. The process of assessing information security threats is separated into a formal representation as a logical formula. Based on the logical formula and threat assessment stages, a diagram of the algorithm is formed. The functional purpose of the diagram components is described. The issues for further study in the implementation of the software package of automating the assessment of information security threats by the expert system method are identified.