Substantial formulation of the task of improving the information model of decision-making in the prompt (crisis) response to cyber incidents

The need to ensure prompt (crisis) response to cyber incidents in a limited time determines the improvement of the information model of decision-making. The fundamental impossibility of achieving algorithmic and informational completeness of technical means of cybersecurity involves the implementation of the process of supporting the adoption of appropriate decisions by the operational staff of cybersecurity. Preparation and selection of solutions by the operational staff are based on studying and analyzing information about the state of operation of the object, taking into account the properties of the operating environment in the operational-pragmatic context. The research results show that cybersecurity operators spend 30-60% of the total duration of the decision-making process on the study and understanding of the content of the information model, depending on the level of professional training. One of the best ways to improve the quality of the information model is to add to its content a list of possible solutions that take into account the specific initial conditions of the object and the calculation of the expected effect. The choice of a solution from a set of pre-formed by technical means allows improving the indicators of prompt(crisis) response time in conditions of different professional training of cybersecurity operators. To solve the problem of forming a list of solutions that will be used for responding to the malfunction of the object of cybersecurity, under certain conditions, with the assessment of their effect, it is possible to use methodological approaches to pattern recognition theory which is based on a mathematical model of recognition. Algebraic, linguistic, heuristic, and structural approaches could be used to develop a model of recognition objects. The use of these approaches is associated with some difficulties: the level of formalization of subject areas cannot be the basis for the formation of models of objects of recognition based on classical mathematical canons; the need for significant computing resources that exceed the effect. Given the limitations of the known approaches to building a model for recognizing the state of the object of cybersecurity, the proposal is to study the possibilities of heuristic extension of algorithmic procedures based on the chosen system of fundamental truth.