METHOD FOR IDENTIFYING SOFTWARE VULNERABILITIES FORMING THE CONDITIONS FOR INFORMATION SECURITY VIOLATION IN AN INFORMATION SYSTEM DUE TO A COMPUTER ATTACK Russian patent published in 2022 - IPC G06F21/57 G06F17/16 

FIELD: information protection.

SUBSTANCE: method for identifying software vulnerabilities forming the conditions for information security violation in an information system due to a computer attack consists in forming a set of types of terms of known computer attack techniques (hereinafter referred to as techniques) and vulnerabilities identified by analysing the descriptions of techniques and vulnerabilities; determining the weights of each type of terms by an expert evaluation method; forming an ordered vector of types of terms with account to the weights; forming vector representations of each technique and vulnerability included in the formed set, represented as values of the types of terms; calculating measures of matching of the descriptions of techniques and vulnerabilities in order to determine identity thereof; and forming a list of vulnerabilities required to implement a computer attack based on the calculated measures of matching of the descriptions of techniques and vulnerabilities.

EFFECT: higher effectiveness of forming a list of information system vulnerabilities, the operation whereof may lead to a violation of information security in the information systems.

1 cl, 1 dwg