The article considers a method of automated formation of a training data set for machine learning algorithms for classification of electronic documents, which differs from the known ones by forming training data sets based on the synthesis of clustering and data augmentation methods based on calculating the distance between objects in multidimensional spaces.

Keywords: teaching with a teacher, clustering, pattern recognition, machine learning algorithm, electronic document, vectorization, formalized documents

The article considers the methodology of forming and determining the parameters of machine learning algorithms for classifying electronic documents according to the importance of information for officials of organizations, which differs from the known ones by the dynamic formation of the structure and number of machine learning algorithms, due to the automated determination of sets of structural divisions of the organization, sets of keywords reflecting the tasks and functions of structural divisions in the process of automated analysis of the Organization's Regulations, The positions of structural units based on the theory of pattern recognition.

Keywords: lemmatization, pattern recognition, machine learning algorithm, electronic document, vectorization, formalized documents

The article considers a probabilistic-temporal model for assessing the intelligence protection of a group of unmanned aerial vehicles for military purposes from enemy radio and radio intelligence complexes in service with the US Army, provides analytical expressions and a calculation sequence with examples.

Keywords: intelligence security, a group of unmanned aerial vehicles, the probability of temporary contact, the probability of energy detection, stealth, signal-to-noise ratio, surveillance reconnaissance zone, detailed reconnaissance zone, radio and radio intellig

The article considers the well-known methods for comparing graphic images. To improve the accuracy of comparison of low-informative images, which are used as formalized symbols of elements on topographic maps, the paper proposes a method for comparing low-informative graphic images, consisting of a set of image comparison methods - the root mean square deviation of the pixels of one image from another and the method of pixel-by-pixel comparison of images. The definition of a formalized graphic document is given. A detailed description of the proposed methodology is presented. By way of example of two data sets, consisting of graphic elements distributed by classes depending on their style, the operation of the technique was tested and the optimal parameters were experimentally selected in the context of solving the problem. The results of the computational experiments carried out in the paper showed the effectiveness of its application in comparison with known methods for solving the problem.

Keywords: image comparison, technique, formalized graphic document, root mean square deviation, pixel-by-pixel comparison, experiment, low-informative image, class, topographic map, image size

The development of cyber intelligence as a new way of detecting information (information technology) objects in cyberspace is considered, its relationship with the OSI network model is shown, the development of cyber intelligence systems in everyday conditions is determined. Models of information technology object detection systems in the conditions of a complex electronic environment in the information space are presented.

Keywords: cyber intelligence, classification, cyberspace, detection, information and technical objects

The article discusses the use of cybernetic space for the detection of n-dimensional information technology objects and their subsequent identification. A conceptual model of a multidimensional intelligence and search system is presented, the intelligence cycle of searching for information and technical objects is described, as well as the relationship of radio intelligence with cybernetic intelligence.

Keywords: identification, information technology object, infosphere, cyberspace, detection, intelligence, intelligence cycle, recognizing

The relevance of the study is due to the need to increase the level of automation of the data collection process when using the services of information security centers (security operation centers) and information security incident management systems (SIEM systems). The article presents a comparison of the most popular SIEM systems, as well as the possibilities of their connection to various data sources on identified events and incidents of information security. This article is aimed at identifying a method (or method) for collecting data on information security events and incidents using console I/O information interaction interfaces in automatic mode. The requirements for the process of automatic data collection on identified events and incidents of information security are defined. The possibilities of the available mathematical apparatus allowing to evaluate the effectiveness of the proposed solution are revealed. An algorithm is presented that allows to implement the proposed solution to the software implementation. The materials of the article are of practical value for specialists and developers working in the field of information security, as well as theoretical value for researchers carrying out their research both in the field of information security and in the field of information technology in general.

Keywords: database, data collection, information security event, information security incident, information security, information security center, SIEM system, automated control system, automation, database interface

A model that implements a method for assessing the security of a special purpose automated information system is considered in the article. The model takes into account both the intensity of the load on the system and the number of channels as a means of protecting information from DDoS attacks based on the combination of theoretical and empirical approaches to assessing security of special purpose automated information system. The transition from a theoretical model using empirical states and continuous time to a discrete time model is applied to build a new model. The purpose of the work is to develop a model that implements a method for assessing the security of a special purpose automated information system against DDoS attacks based on a theoretical-empirical approach to modeling information protection means against DDoS attacks.The following tasks are solved in the article: analysis of known models that implement the method for assessing the security of special purpose automated information system from DDoS attacks; the model which implements a method for assessing the security of special purpose automated information system based on a theoretical-empirical approach to modeling information protection against DDoS attacks is being developed. The use of the new model makes it possible to apply both empirical values obtained as a result of measurements or modeling, and a theoretical basis for modeling information protection means under the influence of DDoS attacks, taking into account their characteristics, which will be reflected by the income function and the choice of the optimal mode of functioning of the special purpose automated information system in discrete moments in time. When synthesizing the models presented in the article, the lack of the static nature of the assessment of the security of the special purpose automated information system was eliminated, the intensity of computer attacks such as DDoS, which dynamically changes both the parameters evaluating the means of protection and the probability of the system being in critical states, was taken into account.

Keywords: automated system, modeling, security assessment, queuing system, probabilistic assessment, DDoS attack

The paper provides an analysis of the principles of the multichannel protection system. The analysis showed that in order to solve the problem of ensuring secure communication with an external resource through public networks, it is advisable to use a multi-channel system with different channel capacities, while the main channel and spare channels that are connected to work when the main channel cannot handle all incoming applications with probability of 0.95. This model takes into account that the channels are filled hierarchically, and are freed up as the applications are processed.

Keywords: automated system, modeling, protection subsystem, queuing system, probabilistic assessment