A MATHEMATICAL MODEL FOR THE INTEGRAL ASSESSMENTOF INFORMATION SECURITY THREAT LEVELS IN INFORMATIONAND TELECOMMUNICATION SYSTEMS BASED ON SIEM INDICATORS

Abstract

This article proposes a mathematical model for the comprehensive assessment of information security threats in information and telecommunications systems based on indicators derived from SIEM systems. The relevance of the study is driven by the increasing intensity and combined nature of cyber threats, which means that a separate analysis of security events no longer provides a sufficiently comprehensive assessment of the security status. The feasibility of transitioning from analysing isolated events and system state parameters to a formalized set of quantitative indicators for subsequent multifactorial assessment is substantiated. A formalization of the system of threat indicators has been carried out, which is divided into two interrelated groups: event indicators and indicators of the state of components of the thinformation and telecommunications system. Event indicators are defined as normalized, aggregated assessments of security events over a given observation interval, incorporating weighting coefficients that reflect the criticality of individual events, their potential impact on the system, and their significance within the overall threat structure. Status indicators are presented as relative metrics that characterize the proportion of system components for which relevant risk signs have been detected, specifically the presence of vulnerabilities, outdated or unlicensed software, and incorrect security measures. Based on the developed indicator system, an integrated model for assessing the threat level has been constructed as a weighted linear combination of the normalized indicators. To determine the weighting coefficients of the indicators, a hierarchical analysis method was applied, which formalized their relative importance, yielded a consistent system of weights, and ensured the interpretability of the integrated assessment. The proposed approach ensures the conversion of indicators that are heterogeneous in nature and scale to a single scale, creating a methodological basis for a comprehensive analysis of the system’s security status. The results confirmed the model's logical consistency, its sensitivity to changes in the values of the most significant indicators, and its practical applicability to multifactorial threat-level assessment. It has been demonstrated that the model can serve as an analytical basis for decision-making in security monitoring processes, for identifying dangerous trends, and for further developing means for the intelligent assessment of the security status of ITS