Model for Analyzing Network Activity of Elements in a Telephone IP Network Using an Intruder’s Computer Reconnaissance System

Objective: to develop and analyze a stochastic model of the process of analyzing the network activity of elements of a telephone IP network performed by an intruder's computer intelligence (CI) complex to quantify the time characteristics of the intelligence cycle. Methods: the network scanner's algorithm is presented as a stochastic network (GERT model), where the stages of detecting active elements, determining the roles of nodes, types of operating systems, ports/services, and analyzing vulnerabilities are described by arcs with their own time distribution functions and success probabilities, and repeated launches are represented by return loops. For the Role, OS, and Ports/Services branches, equivalent Laplace images of the distribution densities are obtained, based on which equivalent functions are derived for the parallel block and the full cycle of the scanner's operation in full and partial scan modes. The integral distribution function, average time, and level of requirements are calculated based on the obtained analytical expressions. Results: compact formulas for the equivalent function, distribution function, and average time of VoIP network intelligence are obtained, depending on the probabilities of successful completion of key operations. It is shown that the time characteristics of the process have a pronounced nonlinear dependence on the values of these probabilities: as the probabilities increase, the average time and the time required for successful completion of the scan decrease significantly. A comparison of full and partial scan modes demonstrates the expected compromise between the completeness of the information obtained by computer intelligence and the speed of obtaining results. Practical significance: the model allows for predicting the time characteristics of the CI complex's operation in a VoIP network, identifying “bottlenecks”, and quantifying the impact of network architecture and security measures on the speed at which an intruder can obtain critical information, providing a basis for making informed decisions to enhance cyber resilience.