Dynamic Expert System-Based Geographically Adapted Malware Risk Evaluation Method

Abstract

Fast development of information systems and technologies while providing new opportunities for people and organizations also make them more vulnerable at the same time. Information security risk assessment helps to identify weak points and preparing mitigation actions. The analysis of expert systems has shown that rule-based expert systems are universal, and because of that can be considered as a proper solution for the task of risk assessment automation. But to assess information security risks quickly and accurately, it is necessary to process a large amount of data about newly discovered vulnerabilities or threats, to reflect regional and industry specific information, making the traditional approach of knowledge base formation for expert system problematic. This work presents a novel method for an automated expert systems knowledge base formation based on the integration of data on regional malware distribution from Cyberthreat real-time map providing current information on newly discovered threats. In our work we collect the necessary information from the web sites in an automated way, that can be later used in a relevant risk calculation. This paper presents method implementation, which includes not only knowledge base formation but also the development of the prototype of an expert system. It was created using the JESS expert system shell. Information security risk evaluation was performed according to OWASP risk assessment methodology, taking into account the location of the organization and prevalent malware in that area.

Method for Attack Tree Data Transformation and Import Into IT Risk Analysis Expert Systems

“…Still, in order to demonstrate that automatically generated rules are practically applicable, the earlier expert system prototype developed by our team and utilizing the OWASP Risk Rating Methodology [55] was used. The system prototype is JESS based and was presented in [10]. The generated rules, including information attack success rates, were imported from the tree, presented in Figure 16.…”

“…The idea of automating knowledge base formation is relatively new; still, some research on the area was already done, and currently, proposed methods have demonstrated the possibility and benefits of such an approach. In our previous research, methods for transformation of ontologies into expert system (ES) knowledge base format [9] and integration of data from websites on regional malware distribution [10] for further use in the expert system-based risk analysis were discussed.…”

“…This method enables the integration of sources that have a deep structure and keeps valuable information on possible recommended controls in the expert systems' knowledge base. In our further research [10] the applicability of data importation to the knowledge base from the websites was analyzed; specifically, regional malware distribution was imported to prove the influence of geographical threat prevalence on the risk assessment results. It has also ensured regular (in fact daily) updates for the knowledge base.…”