FIELD: information protection.
SUBSTANCE: method for identifying software vulnerabilities forming the conditions for information security violation in an information system due to a computer attack consists in forming a set of types of terms of known computer attack techniques (hereinafter referred to as techniques) and vulnerabilities identified by analysing the descriptions of techniques and vulnerabilities; determining the weights of each type of terms by an expert evaluation method; forming an ordered vector of types of terms with account to the weights; forming vector representations of each technique and vulnerability included in the formed set, represented as values of the types of terms; calculating measures of matching of the descriptions of techniques and vulnerabilities in order to determine identity thereof; and forming a list of vulnerabilities required to implement a computer attack based on the calculated measures of matching of the descriptions of techniques and vulnerabilities.
EFFECT: higher effectiveness of forming a list of information system vulnerabilities, the operation whereof may lead to a violation of information security in the information systems.
1 cl, 1 dwg
| Title | Year | Author | Number |
|---|---|---|---|
| METHOD OF EVALUATING SECURITY OF INFORMATION RESOURCE BASED ON EVALUATING POTENTIAL COMPUTER ATTACK TECHNIQUES | 2023 |
|
RU2830484C1 |
| METHOD OF CONTROLLING PROTECTION SURFACE OF CORPORATE COMMUNICATION NETWORK | 2023 |
|
RU2824314C1 |
| METHOD OF PRIORITIZING INFORMATION SECURITY THREATS BASED ON DATA FROM OPEN SOURCES | 2023 |
|
RU2833413C1 |
| METHOD AND SYSTEM FOR AUTOMATED DOCUMENTATION OF SECURITY THREATS AND VULNERABILITIES RELATED TO AN INFORMATION RESOURCE | 2022 |
|
RU2789990C1 |
| METHOD FOR AUTOMATED TESTING OF SOFTWARE AND HARDWARE SYSTEMS AND COMPLEXES | 2018 |
|
RU2715025C2 |
| METHOD OF DETERMINING ACTUAL THREATS TO INFORMATION SECURITY OF INFORMATION INFRASTRUCTURE OBJECTS BASED ON WORD VECTORIZATION METHOD IN ARTIFICIAL NEURAL NETWORK | 2024 |
|
RU2833173C1 |
| METHOD OF AUTOMATED DESIGN ENGENEERING OF HARDWARE AND SOFTWARE SYSTEMS AND COMPLEXES | 2017 |
|
RU2659740C1 |
| CONTROL SYSTEM FOR SECURITY POLICY OF ELEMENTS OF CORPORATE COMMUNICATION NETWORK | 2023 |
|
RU2813469C1 |
| METHOD OF DETERMINING ACTUAL THREATS TO INFORMATION SECURITY OF INFORMATION INFRASTRUCTURE OBJECTS | 2024 |
|
RU2834868C1 |
| METHOD OF DETERMINING POTENTIAL THREATS TO INFORMATION SECURITY BASED ON INFORMATION ON VULNERABILITIES OF SOFTWARE | 2019 |
|
RU2705460C1 |
