Abstract The processing of personal data gives a rise to many privacy concerns, and one of them is to ensure the transparency of data processing to end users. Usually this information is communicated to them using privacy policies. In this paper, the problem of user notification in case of data breaches and policy changes is addressed, besides an ontology-based approach to model them is proposed. To specify the ontology concepts and properties, the requirements and recommendations for the legislative regulations as well as existing privacy policies are evaluated. A set of SPARQL queries to validate the correctness and completeness of the proposed ontology are developed. The proposed approach is applied to evaluate the privacy policies designed by cloud computing providers and IoT device manufacturers. The results of the analysis show that the transparency of user notification scenarios presented in the privacy policies is still very low, and the companies should reconsider the notification mechanisms and provide more detailed information in privacy policies.

Nowadays the collection and usage of users' personal data have become an extremely common scenario. The users actively provide their personal data to customize or improve the quality of various digital services. Privacy policies are the only official way to inform data owners how their personal data are processed. There are different approaches for increasing the transparency of privacy policies and user agreements. This paper discusses ontology-based approaches and proposes formal descriptions of data processors' obligations relating to policy change and notification in case of a data breach.

The task of the insider threat detection is one of the most sophisticated problems of the information security. The analysis of the logs of the access control system may reveal on how employees move and interact providing thus better understanding on how personnel observe security policies and established business processes. The paper presents an approach to the detection of the location-centric employees' interaction patterns. The authors propose the formal definition of the interaction patterns and present the visualization-driven technique to the extraction of the patterns from the data when any prior information about existing interaction routine and procedures is not available. The proposed approach is demonstrated on the data set provided within VAST MiniChallenge-2 2016 contest.

The analysis of the employees’ movement within organization building is an important task of the investigation of the business processes existing in the organization, including provision its cyberphysical security. In the paper, the motif-based approach to behavior pattern description and anomalies in organization staff movement is proposed. The motif of the employees’ movement represents a combination of the spatial and temporal attributes of the movement enforced by attributes of the visited controlled zone. The usage of motifs enables transformation of the raw logs from the proximity sensors of the access control system containing only identifiers of the controlled zones into semantically meaningful list of the activities. This approach is demonstrated with an application to the 2016 VAST Mini-Challenge 2 data set, which describes movement of the employees within organization building.

One of the important direction of research in situational awareness is implementation of visual analytics techniques which can be efficiently applied when working with big security data in critical operational domains. The paper considers a visual analytics technique for displaying a set of security metrics used to assess overall network security status and evaluate the efficiency of protection mechanisms. The technique can assist in solving such security tasks which are important for security information and event management (SIEM) systems. The approach suggested is suitable for displaying security metrics of large networks and support historical analysis of the data. To demonstrate and evaluate the usefulness of the proposed technique we implemented a use case corresponding to the Olympic Games scenario.

The paper is devoted to the analysis of the network protection mechanism "nervous network system" based on the bio-inspired metaphor. Packet-level simulation is proposed in order to investigate the "nervous network system" protection mechanism. We describe the architecture of the protection system based on the given mechanism, its operation algorithms and present results of the experiments. Using obtained results the efficiency of the protection mechanism "nervous network system" against infrastructure attacks is analyzed.

The paper proposes the architecture of the visualization component for the Security Information and Event Management (SIEM) system. The SIEM systems help to comprehend large amounts of the security data. Visualization is the essential part of the SIEM systems. The suggested architecture of the visualization component allows incorporating different visualization technologies and extending easily the application functionality. To illustrate the approach, we developed the prototype of the SIEM visualization component. The paper demonstrates the graphical user interface of the attack modeling component. To increase the efficiency of the visualization techniques we applied principles of the human information perception and interaction issues when designing graphical components.