MODEL FOR PREDICTING STRUCTURAL CHANGES IN THE SPACE OF POSSIBLE IMPLEMENTATIONS OF CYBERATTACK TECHNIQUES BASED ON TOPOLOGICAL CONSTRAINTS OF THEIR EVOLUTION USING TEMPORAL GRAPH NEURAL NETWORKS

In the context of the issue of increasing the cyber resilience of information and communication systems (ICS), the scientific task of predicting structural changes in cyberattack techniques in the space of their possible implementations is solved using the MITRE ATT&CK taxonomy as an example. The relevance of the above is due to the objective limitations of existing approaches to hunting for new ways of implementing cyberthreats (preventing cyberattacks before their implementation), in particular by means of machine learning. Thus, existing types of artificial neural networks used to predict cyberattacks (cyberattack techniques), such as recurrent, transformer, convolutional, graph, temporal graph and autoencoders, although they take into account various aspects of the data structure (feature space, temporal dependencies, global context, graph structure, latent representations, data distribution), approximating the function of interdependence between data, reveal only a statistical structure, which does not allow fully taking into account stable structural evolutionary patterns. In this regard, a model for predicting structural changes in cyberattack techniques in the space of possible implementations based on topological constraints on their evolution using temporal graph neural networks has been developed. The essence of the proposed model is to adjust the results of predicting a temporal graph network based on topological analysis of versions of cyberattack techniques by determining their structural compatibility through joint participation in connectivity components and cyclic structures that reflect stable topological characteristics of their evolution. The feasibility of this approach is due to the value of identifying potential vectors of cyberattack transformation in the space of their possible implementations, which makes it possible to increase the cyber resilience of the ICS to future classes of cyberattacks. An assessment of the effectiveness of the proposed model demonstrates a 15% increase in prediction accuracy and an 8% increase in F1-measure while maintaining a completeness level of 70%, indicating a significant reduction in the number of false positives.