Calculating the Maximum Response Time of Protection Systems of Industrial Control System Network to the Impact of a DDoS Attack

The purpose of this research is to develop a method for calculating the maximum response time of information protection systems for networks of industrial control systems (ICS) to the impact of a DDoS-attack. This parameter should not exceed the value corresponding to the average time of a successful DDoS attack and can be used when configuring protection systems for ICS networks to minimize the likelihood of a successful DDoS attack or significantly reduce the possible negative consequences of its impact. To achieve the goal, the task of developing a model of an intruder in the preparation and implementation of a DDoS attack was set and solved, based on a stochastic network of this process. The mathematical expectation of the average time of a successful DDoS attack and its dispersion, as well as the dependence of the probability of a successful DDoS attack on its duration in time, are calculated using the method of topological transformation of a stochastic network and the method of two-time approximation. In conclusion, several experiments simulating a DDoS attack were carried out and allowing us to conclude that the real time of the implementation of a successful DDoS attack corresponds to that time calculated with the proposed method.