Abstract:The purpose of the article: conducting a system analysis of the requirements for the subsystem for preventing computer attacks on critical information infrastructure in order to substantiate the directions for further improved scientific and methodological apparatus for the full functioning of the subsystem for preventing computer attacks. Research method: theoretical and systematic analysis of the requirements of legal acts, scientific publications, protection technologies and means of their implementation in departmental systems for detecting and counteringcomputer attacks.The result obtained: the rationale for the need to build mechanisms for preventing computer attacks on critical information infrastructure objects and the requirements for the subsystem for preventing computer attacks was carried out, an approach was proposed to prevent computer attacks at the stages of reconnaissance by an attacker of critical information infrastructure objects, based on the introduction of a security event correlation mechanism with automatic adaptation to the analyzed information infrastructure and the functions it performs at the current time and a detailed specification of the correlation rules.Scope of the proposed approach: a subsystem for preventing computer attacks of departmental systems for detecting and countering computer attacks, which should identify and prevent attempts to conduct computer attacks on critical information infrastructure objects in advance.The scientific novelty consists in a comprehensive analysis of the need to build mechanisms for preventing computer attacks on critical information infrastructure objects, an analysis of the requirements for the computer attack prevention subsystem, its functions and means of implementation. It is shown that the functions of preventing computer attacks in domestic technical solutions are not fully implemented, and that there is a substitution of the concept of “subsystem for preventing computer attacks” by the concept of “control and technical measures”. It is substantiated that for the implementation of the functions of preventing computer attacks, there is a technological backlog in the form of a ready-made technology based on the technology for building SIEM systems. It is shown that there is a need to refine the scientific and methodological apparatus for implementing computer warning functions based on artificial intelligence methods and big data technologies.Contribution: Kotenko I.V. - analysis of the functionality of the subsystem for preventing computer attacks, setting the task and proposals for developing the functionality of the subsystem for preventing computer attacks on critical information infrastructure objects; Saenko I.B. - analysis of the subsystem for preventing computer attacks in the general context of the theory of information security, substantiation of the implementation of the functions of preventing computer attacks based on the technology of building SIEM systems and big data; Zakharchenko R.I. - analysis of technical solutions that ensure the implementation of the subsystem for preventing computer attacks, Velichko D.V. - an approach to detecting computer attacks at the stages of reconnaissance by an attacker of objects of critical information infrastructure. All authors participated in the writing of the article.

Closing the loop of SIEM analysis to Secure Critical Infrastructures

Critical Infrastructure Protection: having SIEM technology cope with network heterogeneity

Toward the Integration of Cyber and Physical Security Monitoring Systems for Critical Infrastructures

Survey on Intrusion Detection Systems Based on Machine Learning Techniques for the Protection of Critical Infrastructure

SIERRA: Ranking Anomalous Activities in Enterprise Networks

A Systematic Analysis of Security Metrics for Industrial Cyber–Physical Systems

An Adaptable Approach for Successful SIEM Adoption in Companies

URBAN-NET: A Network-Based Infrastructure Monitoring and Analysis System for Emergency Management and Public Safety.

Integrated protection of industrial control systems from cyber-attacks: the ATENA approach

Review of Security Issues in Industrial Networks

Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection

Critical Infrastructure Protection: Generative AI, Challenges, and Opportunities

Cross-Domain Security Asset Management for Healthcare

Utilizing Semantic Big Data for Realizing a National-Scale Infrastructure Vulnerability Analysis System

Anomaly-Based Intrusion Detection System for Cyber-Physical System Security

Revolutionizing SIEM Security: An Innovative Correlation Engine Design for Multi-Layered Attack Detection

You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks

Securing critical infrastructures with a cybersecurity digital twin

Critical Utility Infrastructural Resilience

A self-adaptation-based approach to resilience improvement of complex internets of utility systems

Subsystem for Prevention of Computer Attacks Against Objects of Critical Information Infrastructure: Analysis of Functioning and Implementation