Abstract:The purpose of the article: conducting a system analysis of the requirements for the subsystem for preventing computer attacks on critical information infrastructure in order to substantiate the directions for further improved scientific and methodological apparatus for the full functioning of the subsystem for preventing computer attacks. Research method: theoretical and systematic analysis of the requirements of legal acts, scientific publications, protection technologies and means of their implementation in departmental systems for detecting and counteringcomputer attacks.The result obtained: the rationale for the need to build mechanisms for preventing computer attacks on critical information infrastructure objects and the requirements for the subsystem for preventing computer attacks was carried out, an approach was proposed to prevent computer attacks at the stages of reconnaissance by an attacker of critical information infrastructure objects, based on the introduction of a security event correlation mechanism with automatic adaptation to the analyzed information infrastructure and the functions it performs at the current time and a detailed specification of the correlation rules.Scope of the proposed approach: a subsystem for preventing computer attacks of departmental systems for detecting and countering computer attacks, which should identify and prevent attempts to conduct computer attacks on critical information infrastructure objects in advance.The scientific novelty consists in a comprehensive analysis of the need to build mechanisms for preventing computer attacks on critical information infrastructure objects, an analysis of the requirements for the computer attack prevention subsystem, its functions and means of implementation. It is shown that the functions of preventing computer attacks in domestic technical solutions are not fully implemented, and that there is a substitution of the concept of “subsystem for preventing computer attacks” by the concept of “control and technical measures”. It is substantiated that for the implementation of the functions of preventing computer attacks, there is a technological backlog in the form of a ready-made technology based on the technology for building SIEM systems. It is shown that there is a need to refine the scientific and methodological apparatus for implementing computer warning functions based on artificial intelligence methods and big data technologies.Contribution: Kotenko I.V. - analysis of the functionality of the subsystem for preventing computer attacks, setting the task and proposals for developing the functionality of the subsystem for preventing computer attacks on critical information infrastructure objects; Saenko I.B. - analysis of the subsystem for preventing computer attacks in the general context of the theory of information security, substantiation of the implementation of the functions of preventing computer attacks based on the technology of building SIEM systems and big data; Zakharchenko R.I. - analysis of technical solutions that ensure the implementation of the subsystem for preventing computer attacks, Velichko D.V. - an approach to detecting computer attacks at the stages of reconnaissance by an attacker of objects of critical information infrastructure. All authors participated in the writing of the article.

INTEGRATION AND AUTOMATION IN ACTIVE PROTECTION OF NETWORK RESOURCES: PROSPECTS FOR DEVELOPMENT

Proactive Security Defense of Dynamic Network

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Threats and Opportunities with AI-based Cyber Security Intrusion Detection: A Review

Automation for network security configuration: state of the art and research trends

The Role of AI In Enhancing Threat Detection and Response in Cybersecurity Infrastructures

REACT: Autonomous Intrusion Response System for Intelligent Vehicles

Automated Cyber Defence: A Review

Exploiting AI Capabilities: An in-Depth Analysis of Artificial Intelligence Integration in Cybersecurity for Threat Detection and Response

Innovative solutions for critical infrastructure resilience against cyber-physical attacks

When Autonomous Intelligent Goodware will Fight Autonomous Intelligent Malware: A Possible Future of Cyber Defense

Integrated protection of industrial control systems from cyber-attacks: the ATENA approach

A self-adaptation-based approach to resilience improvement of complex internets of utility systems

Subsystem for Prevention of Computer Attacks Against Objects of Critical Information Infrastructure: Analysis of Functioning and Implementation

Automation Security

The Effectiveness of a Comprehensive threat Mitigation Framework in NETWORKING: A Multi-Layered Approach to Cyber Security

Dynamic defenses in cyber security: Techniques, methods and challenges

ANALYSIS OF APPROACHES OF INFLUENCE OF ELECTRONIC WARFARE MEANS ON THE ON THE NETWORK-CENTRIC CONTROL SYSTEM

HARMer: Cyber-attacks Automation and Evaluation

Cyber Autonomy: Automating the Hacker- Self-healing, self-adaptive, automatic cyber defense systems and their impact to the industry, society and national security

AI Enhanced Automatic Response System for Resisting Network Threats.