Подход к моделированию поведения нарушителя в государственных информационных системах на основе скрытых марковских моделей

XXI век: итоги прошлого и проблемы настоящего плюс. 2026. Т. 15. № 2(74). С. 20–25.

Шейкин В. В., Starodubov K., Карасев П. И.

The paper addresses the problem of formalized description of intruder behavior in government information systems. An approach based on hidden Markov models is proposed for modeling the actions of an intruder, where the stages of malicious activity are interpreted as hidden states and the events registered by the system are treated as observable symbols of a probabilistic model. A methodology for constructing a hidden Markov model is presented, including the definition of hidden states, the selection of observable events, and the specification of transition and emission probabilities. A theoretical example is used to demonstrate how the proposed model can describe the sequence of an intruder's actions and support the analysis of possible attack scenarios. The paper also discusses the applicability of this approach to security monitoring and penetration testing, as well as its limitations related to model parameterization and data completeness.

Keywords: информационная безопасность, государственные информационные системы, скрытые Марковские модели