METHOD AND SYSTEM FOR GENERATING THE LIST OF COMPROMISE INDICATORS Russian patent published in 2021 - IPC G06F21/56 

FIELD: computer engineering.

SUBSTANCE: computer-implemented method for generating the list of indicators of compromise, wherein a malware carrier is obtained, intended for preparing for the launch and / or launch of at least one primary malware module, an attack roadmap is developed by detecting additional malware carriers and / or the principal malware module and the sequence of their execution is determined, stipulated by the execution algorithm of the obtained malware carrier. At least one attack roadmap is found in the database, which coincides with the developed roadmap with the preset level of accuracy; the lists of indicators of compromise are extracted from the database for each malware carrier and / or the primary malware module from at least one found attack roadmap. The complete list of indicators of compromise is generated based on the compiled lists of indicators of compromise and the records of combined lists of compromise indicators extracted from the database; the compiled lists of compromise indicators are saved for each detected malware carrier or the primary malware module, as well as the complete list of compromise indicators in the database.

EFFECT: ensured countermeasures against advanced attacks on the network infrastructure.

14 cl. 7 dwg