The paper studies the methodical approach to building mathematical models for timing determination of illegal actions on information resources of computer systems in order to substantiate requirements to methods and facilities of protecting information from unauthorized access. In the paper a version of the logical-linguistic representation of functional description of such activities as a tool of their primary formalization was adduced.