The principles of cyber attacks detection that based on media content are described. Proposed methods are suitable for description of the general trends in the dynamics of information flows concerning cyber incidents. A generalized diagram of cyber attacks stages displaying in the media space is proposed. On the basis of the diagram the basic wavelet functions are selected, which can be considered as a reference for detecting cyber incidents. The proposed wavelets are low-order derivatives of Gaussian function (Wave, «Mexican Hat» and Morlaix wavelets). Retrospective analysis of already implemented information operations is a reliable way to verify them. The problem of forecasting is partly solved by probabilistic estimates in accordance with the type of reference functions.