Identification of Associative Rules in the Behaviour of Automated Systems Information Security Intruders

An approach based on the use of one of the varieties of affinity analysis – associative rule search, which allows to identify associative rules in the use of various methods of port scanning and operating system characterization by intruders of information security of automated systems is proposed. The mechanism of associative rule search using the scalable apriori algorithm is described. The basic concepts and an example of application of this mechanism with calculation of necessary characteristics such as support, confidence and lift were considered. The obtained associative rules will enable information protection specialists to be better oriented in the nature of actions of information security violators of automated systems and will become the basis for making informed managerial decisions on improving the existing or building a new information protection system, more effective response to information security incidents.