ARCHITECTURE OF A MODULAR EXPERT SYSTEM FOR VERIFICATION OF SECURITY POLICIES IN MULTI-TIER INFORMATION ENVIRONMENTS

Abstract

The article considers the problem of security policy verification in multi-level, distributed and dynamic information environments. The limitations of traditional centralized approaches are shown in the context of the increasing complexity of modern information systems and the number of interconnected policies. The feasibility of using modular expert systems to increase the flexibility, scalability and adaptability of security policy verification processes is substantiated. The emphasis is on the need for formalized policy representation and automated detection of conflicts and gaps in access rules. The proposed approach is focused on use in heterogeneous environments with a multi-level security control structure. The aim of this study is to develop an architecture for a modular expert system for verifying security policies in multi-level information environments. The research is based on the use of methods of formalization of security policies, logical analysis of access rules and modular design of expert systems. Experimental modeling and comparative analysis with existing solutions were used to evaluate the effectiveness of the proposed approach. An architectural model of an expert system with independent verification modules synchronized through a centralized controller is proposed. Experimental results confirm an increase in the speed of policy verification, improved scalability, and reduced knowledge update time compared to traditional approaches. The scientific novelty lies in the combination of a modular approach with a hierarchical model of the information environment for verifying security policies. The proposed architecture provides consistent verification of policies at different levels without interfering with the internal logic of individual modules. The results obtained confirm the effectiveness of the modular expert system for application in complex information environments. The proposed approach can be used as a basis for creating tools for automated control and analysis of security policies in critical information systems.