Algorithm for Conducting Information Security Audit in Organizations Based on a Multilevel Model Based on Graph Theory

Abstract

This paper presents a multi-level topological model for auditing information security of critical information infrastructure (CII) objects, developed using graph theory. The model accounts for resource costs, technical impacts (ITE), vulnerability levels, potential damage, and object elements. The proposed framework enables the identification of optimal testing scenarios based on an "efficiency/cost" criterion, supporting the formation of comprehensive test sets for thorough audit coverage. An algorithm was developed to implement the model, which includes graph construction across hierarchical layers and application of Dijkstra’s shortest path algorithm to determine the most cost-effective information-technical effects. Additionally, a software tool was created using C# to visualize the graph, manage input data, and dynamically calculate optimal audit paths and damage estimates. A comparative analysis highlights the strengths and limitations of the graph-based model in comparison to traditional audit methods, including compliance audits, risk assessments, penetration tests, and automated monitoring. The graph-based approach stands out for its flexibility, scientific foundation, and ability to prioritise critical vulnerabilities and efficiently audit resources in constrained environments.