A semi-Markov model for evaluating the effectiveness of information security software systems

Objective. The purpose of this work is to develop and substantiate a mathematical model for evaluating the probabilistic and temporal characteristics of information security software systems (ISSS) in the process of monitoring their effectiveness.
Method. A mathematical framework based on finite semi-Markov processes (FSPs) is proposed as a solution to the problem. This allows for an adequate description of the stochastic nature of the functioning of the PSSI and takes into account the distribution of the system's dwell time in various states.
Result. A mathematical model for assessing the probabilistic-temporal characteristics of a security system (PSS), based on the KPP framework, is proposed. The model adequately describes the stochastic nature of PSS operation and accounts for arbitrary laws of operation time distribution. A quantitative performance indicator is introduced, defined as the probability of performing protective functions within a time limit not exceeding the maximum permissible time. To analytically calculate this indicator, the system of integral equations describing the PPS dynamics is reduced to a system of linear algebraic equations solved using the Gaussian method using the Laplace-Stieltjes transform.
Conclusion. This approach ensures analytical analysis of the probabilistic and temporal characteristics of security systems. A system of linear equations allows for calculating the integrated system performance indicator without simulation, which is valuable for operational monitoring. The method can be easily algorithmized and integrated into automated monitoring tools for secure automated systems.

1. GOST R ISO/IEC 15408-1–2012. National Standard of the Russian Federation. Information Technology. Security Techniques. Evaluation Criteria for IT Security. Part 1. Introduction and General Model. (approved and enacted by Order of Rosstandart dated November 15, 2012 No. 814-st). Text: electronic. (In Russ)

2. GOST R ISO/IEC 15408-2–2013. National Standard of the Russian Federation. Information Technology. Security Techniques. Evaluation Criteria for IT Security. Part 2. Security Functional Components. (approved and enacted by Order of Rosstandart dated November 8, 2013 No. 1339-st). Text: electronic. . (In Russ)

3. GOST R 56939–2024. National Standard of the Russian Federation. Information Protection. Secure Software Development. General Requirements. (approved by Order of Rosstandart dated October 24, 2024 No. 1504-st). Text: electronic. (In Russ)

4. Guidance Document. The Concept of Protection of Computer Equipment and Automated Systems from Unauthorized Access to Information (approved by the Decision of the State Technical Commission of Russia dated March 30, 1992). Text: electronic. (In Russ)

5. Order of the Federal Service for Technical and Export Control of Russia (FSTEC of Russia) No. 17 of February 11, 2013. On Approval of the Requirements for the Protection of Information Not Constituting a State Secret Contained in State Information Systems. (In Russ)

6. Order of the Federal Service for Technical and Export Control of Russia (FSTEC of Russia) No. 239 of December 25, 2017. On Approval of the Requirements for Ensuring the Security of Critical Information Infrastructure Facilities of the Russian Federation. (In Russ)

7. Malyuk, A.A. Information Security: Conceptual and Methodological Foundations of Information Protection. Moscow: GLT, 2016. — 280 p. (In Russ)

8. Danilenko, A.Yu. Security of Electronic Document Management Systems. Technology for Protecting Electronic Documents. Moscow: Lenand, 2015. 232 p. (In Russ)

9. Shangin, V.F. Information Security and Information Protection: Textbook. Moscow: DMK Press, 2017. — 702 p. (In Russ)

10. Rogozin, E.A., Pitolin, M.V., Makarov, O.Yu. et al. Methods and Tools for Evaluating the Efficiency of the Information Protection Subsystem Design in Electronic Document Management Systems: Monograph. Voronezh: Voronezh State Technical University, 2015. — 106 p. (In Russ)

11. Avsentyev, O.S. et al. Methodology for Managing Information Resource Protection in Electronic Document Management Systems. SPIIRAS Proceedings, 2018;2 (57):188–210. Text: printed. (In Russ)

12. Zastrozhnov, I.I., Rogozin, E.A., Bagaev, M.A. Methodological Foundations of Security in the Use of Information Technologies in Electronic Document Management Systems: Monograph. Voronezh: Scientific Book Publishing Center, 2011. — 252 p. Text: printed. (In Russ)

13. Strazheva, N.A., Kapustina, T.V. Probability Theory and Mathematical Statistics: Textbook for Universities. Moscow: Yurayt, 2021. 311 p. (In Russ)

14. Tikhonov, V.I., Mironov, M.A. Markov Processes. Moscow: Soviet Radio, 1977. 488 p. Text: printed. (In Russ)

15. Ross, S.M. Introduction to Probability Models. Academic Press, 2014. — 784 p.

16. Grinstead, C.M., Snell, J.L. Introduction to Probability. American Mathematical Society, 1997. — 510 p.

17. Kudryavtsev, V.A. (Кудрявцев В.А.), Demidovich, B.P. A Brief Course in Higher Mathematics: Textbook for Universities. Moscow: Nauka, 1989. — 656 p. Text: printed. (In Russ)

18. Bakhvalov, N.S., Zhidkov, N.P., Kobelkov, G.M. Numerical Methods: Textbook for Universities. Moscow: Knowledge Laboratory, 2015. — 636 p. (In Russ)

19. Samarsky, A.A., Gulin, A.V. Numerical Methods: Textbook for Universities. Moscow: Knowledge Laboratory, 2020. — 432 p. (In Russ)