A formal model of an information security incident

The article proposes an approach to formally describing an information security (IS) incident. The criteria for transitioning from an IS event to an incident are formulated: event → IS policy violation → IS violation → incident. An analysis is conducted of existing methods and approaches to describing an IS incident, which make it possible to rank, group, and combine the attacker’s actions against the target object, establish correlations, and justify the moment when active response measures should be initiated. A description of the incident is proposed in the form of an ordered tuple, intended to combine atomic incidents and suspicions into attack chains, taking into account the dynamics of the consequences and the permissible damage to the organization. The proposed approach makes it possible to combine atomic incidents, the response to which in many cases is not required, into complex attack chains, and to effectively implement a response to emerging incidents, taking into account the dynamics of their development within the chains.

1. Sintsov M.I. Reducing the likelihood of the consequences of compromising an enterprise's IT infrastructure through the synergy of using promising methods to identify threats and their subsequent retrospective analysis. Approaches to assessing the quality of the developed correlation rules for retrospective analysis. In: Actual Problems of Information Protection: Modernity and Prospects: Proceedings of the II Scientific and Practical Conference, 09–10 April 2024, Moscow, Russia. Moscow: Bauman Moscow State Technical University; 2025. P. 37–42. (In Russ.).

2. Rakintsev N.A. Information security incidents of the 1st half of 2020 in the transport industry. The introduction of measures to prevent them. Young Scientist. 2020;(27):61–63. (In Russ.).

3. Kotenko I., Fedorchenko A., Saenko I., Kushnerevich A. Big data technologies for security event correlation based on event type accounting. Voprosy kiberbezopasnosti. 2017;(5):2–16. (In Russ.).

4. Kuznetsov A.V. The organization of separate security event data storage. Voprosy kiberbezopasnosti. 2024;(2):22–28. (In Russ.). https://doi.org/10.21681/2311-3456-2024-2-22-28

5. Bukin A., Samonov A., Tihonov E. Detecting information security incidents based on neural network technology. Voprosy kiberbezopasnosti. 2022;(5):61–73. (In Russ.).

6. Landauer M., Skopik F., Wurzenberger M., Rauber A. System log clustering approaches for cyber security applications: A survey. Computers & Security. 2020;92:101739. https://doi.org/10.1016/j.cose.2020.101739

7. Brown A., Tuor A., Hutchinson B., Nichols N. Recurrent Neural Network Attention Mechanisms for Interpretable System Log Anomaly Detection. arXiv. URL: https://arxiv.org/abs/1803.04967 [Accessed 1st May 2026].

8. Tumoyan E.P. Probabilistic automata based computer attack modeling approach. Izvestiya SFedU. Engineering Sciences. 2008;(8):120–126. (In Russ.).

9. Gorev A.I., Goreva E.G. Cyber attacks: some approaches to system analysis. Mathematical Structures and Modeling. 2024;(1):110–116. (In Russ.). https://doi.org/10.24147/2222-8772.2024.1.110-116

10. Kotenko I.V., Saenko I.B., Lauta O.S., Kurakin A.S. Semantic clustering of incidents based on the DBSCAN algorithm and a large language model. Voprosy kiberbezopasnosti. 2026;(2):2–15. (In Russ.). https://doi.org/10.21681/2311-3456-2026-2-2-15

11. Zhukov V.G., Shalyapin A.A., Sokolov M.M. Research of the case analysis algorithm in the classification of problem of information security incidents. Vestnik SibSAU. Aerospace Technologies and Control Systems. 2015;16(3):572–579. (In Russ.).

12. Reznichenko S.A., Turabov D.R. Methodology for selecting effectiveness criteria of information Security Systems during Red Team simulated attacks. Herald of Dagestan State Technical University. Technical Sciences. 2025;52(3):135–151. (In Russ.). https://doi.org/10.21822/2073-6185-2025-52-3-135-151

13. Sintsov M.I. Determining the optimal response time to information security threats in a limited resource environment. Problems of Information Security. Computer Systems. 2025;(4):23–34. (In Russ.). https://doi.org/10.48612/jisp/mp7a-vpp7-xu6f