The article presents an approach to detecting attacks in real time based on simulation and graph-oriented mod- eling. The detection process is performed in a mode close to real-time with the ability to promptly detect known types of security incidents. The distinctive features of the approach include the multidimensional nature of attack detection with the ability to select a specific type of simulation and graph-oriented attack detection model with their subsequent combination. In addition, within the practical part of the work, a software tool has been developed to select the most suitable model apparatus for detecting attacks of each type.