AUTOMATION OF COGNITIVE MODELING OF INFORMATION SECURITY RISKS: EXPERIENCE OF USING MENTAL MODELER AND FCM EXPERT

Abstract

A fundamental element of any security architecture is risk assessment. It allows you to systematize potential threats and vulnerabilities, as well as predict the destructive impact on the confidentiality, integrity and availability of information assets, which is critical for the development of effective protection measures. This work pays special attention to the issue of cognitive risk modeling using specialized software tools, in particular, Mental Modeler and FCM Expert solutions, which allow you to visualize and mathematically substantiate complex relationships in protection systems. The analysis of scientific sources conducted in the work allowed to systematize theoretical foundations and existing practical solutions for risk assessment, in particular the use of SWOT analysis, expert assessment methods, game theory apparatus, fuzzy logic, as well as modern machine learning methods and clustering algorithms. It was established that in conditions of high uncertainty and dynamism of cyberspace, fuzzy cognitive maps (Fuzzy Cognitive Maps – FCM) are one of the most promising approaches. They provide a unique opportunity to combine qualitative expert assessment with quantitative analysis methods, allowing to model various scenarios of events for making informed management decisions. The practical significance of the study lies in demonstrating the possibilities of automating modeling processes using Mental Modeler and FCM Expert. The paper describes in detail the developed architecture of the cognitive model of a conditional organization, which covers key threat vectors, technical and organizational vulnerabilities, as well as existing countermeasures. Based on this model, a simulation of a phishing attack scenario was implemented. A comparative analysis of the results obtained in the two software environments allowed us to clearly distinguish their functional roles. It was found that Mental Modeler was effective for the initial structuring of expert knowledge and rapid visualization of qualitative trends and is optimal for the brainstorming stage. At the same time, FCM Expert achieved a deeper mathematical verification of the scenario by calculating the absolute values of system stabilization, reducing the subjectivity of expert assessment. The results of the study are not only theoretical, but also educational. The materials and developed models were successfully tested in the educational process during the teaching of the discipline “Risk Theory” for applicants for the specialty F5 “Cybersecurity and Information Protection”. This confirms the adaptability of the proposed methods for training specialists capable of operating complex analytical tools in conditions of real challenges to digital security.