On some possibilities of resource management for organizing active counteraction to computer attacks

Rational counteraction to computer attacks, described as event sequences, is discussed. The approach is based on the mathematical technique of learning by precedents, formalizing similarity as a binary algebraic operation. Similarities of event sequences are analyzed. The learned classes of similarity (tolerance classes) are used to recognize computer attacks on initial steps of their life cycle. A problem-oriented resource management technology aimed at developing rational counteraction to attacks of the discussed type is presented.