Burmaka I. Information technology for the detection and analysis of anomalous events for the protection of computer networks of small and medium-sized enterprises based on blockchain.

The thesis addresses the current scientific task of developing models and methods for information technology for protecting computer networks, taking into account the specifics of networks of small and medium-sized enterprises, which are based on methods of information storage and distribution using blockchain technology. Additionally, an important task is to determine the architecture of the intrusion detection information system for small and medium-sized enterprise networks that uses blockchain components. The object of the research is the information processes in cybersecurity systems and the analysis of anomalous traffic in computer networks. The subject of the research was selected methods, models, and elements of collaborative information technology for protection against cyber-attacks and anomalous traffic for computer networks of small and medium-sized enterprises based on blockchain technology. The purpose of the research is to increase the efficiency of protecting computer networks of small and medium-sized enterprises based on blockchain technology. The research task is to build a model of a distributed computer network protection system based on blockchain, relying on the analysis results of the main threats to computer networks, especially networks of small and medium-sized enterprises. The research methodology is based on simulation modeling, UML design of blockchain technology components, mathematical modeling methods for determining optimal parameters of the blockchain subsystem. Expert assessment methods were used to select typical attacks and loads on attacked systems when building simulation models. Object-oriented analysis and functional modeling methods, including SADT design, were used in conceptualizing business processes in the IDEF0 notation, which served as the basis for designing information technology for detecting and analyzing anomalous events to protect computer networks of small and medium-sized enterprises based on blockchain. The main results of the research and the scientific novelty of the work lie in the development of methods, models, and algorithms for protecting computer networks of small and medium-sized enterprises based on blockchain. Based on the analysis of current threats to computer networks of small and medium-sized enterprises, the most effective methods and means of protecting such networks were determined, taking into account the specifics of their operation. The work proposes a list of main classifiers for information technology for protecting computer networks, which can be combined into a comprehensive classifier to improve the accuracy of detecting unknown anomalous events by the distributed intrusion detection system. The developed method for improving the efficiency of resource utilization by evaluating of the probability of successful block creation, and allows reducing the consumption of resources by the blockchain subsystem. For the first time, a conceptual model of a distributed information system for detecting and analyzing anomalous events in the computer networks of small and medium-sized enterprises has been developed. Unlike existing models, it includes a blockchain component for detecting, accumulating, storing, and sharing information about anomalous events, as well as a multi-classifier block for determining the presence of threats, which allows for increased response speed to unknown attacks. A method for selecting a consensus protocol for a distributed intrusion detection system based on blockchain has been proposed for the first time. Unlike existing methods, it takes into account the requirements for equipment, scalability, and management of participants in intrusion detection systems in computer networks, providing support for decision-making when designing protection systems for the computer networks of small and medium-sized enterprises. The functional model of a distributed computer network protection system based on blockchain technology has been further developed for detecting, accumulating, storing, and sharing information about anomalous events. This model defines the main input and output parameters, constraints, and resources with three levels of detail and serves as the foundation for designing protection systems for the computer networks of small and medium-sized enterprises. The practical significance of the obtained results is that they collectively form a new information technology for detecting and analyzing anomalous events to protect the computer networks of small and medium-sized enterprises based on blockchain. The proposed information technology can be used by developers of computer network protection systems, as well as network administrators and IT security specialists of small and medium-sized enterprises. The developed business processes and architecture serve as the basis for developing more powerful and functional distributed intrusion detection systems.