THE INTEGRATION OF CATASTROPHE THEORY INTO DECISION-MAKING MODELS FOR INFORMATION SECURITY MANAGEMENT SYSTEMS

DOI: 10.31673/2412-4338.2025.048903

Abstract

The integration of catastrophe theory into the decision-making process in ISMS on the basis of the DSS/IISS practice as well as the use of SIEM platforms and IDS is dealt with. The focus is to detect critical behaviors in the development trend of a cyber threat, which can occur before a rapid change of system state. Cumulative analysis of cyber attack was done based on statistical data for range of 2022-2024. A global growth related with the activity of threats in cybersecurity was found, this necessity leads to the deployment of new decision-making models valuable in information security management systems (ISMS). Technical features of the IDS were investigated because the IDS is an integral component for securing information in the context of the SIEM and ISMS. It has been revealed that IDS make it possible to collect the information on opened vulnerabilities and also information about a suspicious behavior of a user as well, which creates opportunity to identify the nature of an incident. A model to detect indications of potentially risky trends by the use of IDS signals and an approach to the decision making in a Security Information and Event Management under the catastrophe theory. The study of mathematical models was performed, the main figures of merit of the effectiveness of mathematical models used for normalization, filtration, classification, collection, correlation, prioritization and analysis of events, as well as for the generation of various reports, messages, and visual data display for operational and strategic decision-making were determined. A study for system response based on catastrophe theory and its application. Four simulation case studies with different parameters were designed using Python based on the real data set of cyber incidents at months 2022-2024, data of values at months 2022-2024, and allowed changes of parameters during modeling. Guidelines for creating a response model to detected cyber incidents in the ISMS were established.

Keywords: Catastrophe theory, information security management system (ISMS), Intrusion Detection System (IDS), SEIM-system, bifurcation points, robustness.