MATHEMATICAL MODEL OF EVENTS MONITORING IN THE MANAGEMENT SYSTEM OF DISTRIBUTED DATABASES BASED ON EVENT SENSORS

Methods of increasing the effectiveness of threat detection in distributed databases using the event monitoring system are considered in the work. It is noted that the system works on the basis of the event monitoring model of heterogeneous distributed databases. This model involves three stages of event processing, which are based on appropriate methods. It is highlighted that the mechanisms underlying the functioning of the mentioned methods should be reduced to a single data format to eliminate the possible appearance of incorrect work in future calculations. The event processing method on the monitoring server allows for processing event matrices and transferring the function to control tools, on the basis of which appropriate decisions are made to improve reliability. The article develops a modified method of analyzing and monitoring events in non-relational distributed databases. Event monitoring options for lookup operations in distributed databases are offered. To confirm the theoretical results, mathematical modeling and experimental research on monitoring parameters and data processing speed on the event monitoring server were carried out. The number of detected incidents and the number of incorrectly identified events were studied, which in turn allowed for the protection of information from unauthorized actions or changes. Also, it should be emphasized that the model proposed in the work describes detailed monitoring of requests, transactions, and stored procedures in a database with information about possible incidents in real time and prompts intrusion warnings. In addition, the features of the proposed model make it possible to investigate and monitor the emergence of new vulnerable segments of the database and promptly respond to them, eliminating threats to access channels. The paper compares the speed of data processing based on files and database tables, which allows for fully performing experiments and confirming analytical data experimentally.