METHOD OF PRIORITIZING INFORMATION SECURITY THREATS BASED ON DATA FROM OPEN SOURCES Russian patent published in 2025 - IPC G06Q10/00 G06F16/00 

FIELD: physics.

SUBSTANCE: invention relates to a method for prioritizing information security threats based on data from open sources. In the method, using the software of a computer, which includes a first database (DB 1) associated with the computer software, sending a request to the open source servers to search for reports (Reports) on the investigation of the activities of cybercriminals carrying out computer attacks, which include information on the sectors of the economy subjected to computer attacks, on groups of malefactors, on tactics, techniques and procedures (TTP), which are used by groups of malefactors when conducting computer attacks on industries, as well as methods of counteracting TTP used by groups of malefactors. Found reports are loaded and stored in database 1. With the help of computer software from the All-Russian classifier of types of economic activities (ARCTEA), the types of economic activities (TEA) of the said branches of the economy are added to DB 1. Computer software is used to associate each subject to computer attacks of TEA of the corresponding branch of the economy with the corresponding TTP. Using computer software, reports are analyzed and groups of malefactors and TTPs used by them are selected in accordance with each TEA. Computer software is used to establish links between TEA, a group of malefactors and the TTP used by them in the corresponding branch of the economy. With the help of computer software, information on organizations in respect to which it is necessary to perform profiling of the list of threats (LT) of computer attacks is added to the database, wherein each organization is associated with TEA in database 1. With the help of computer software for each branch of the economy in accordance with TEA, a ranked list of actual threats of computer attacks is created depending on the frequency of use of the corresponding TTP from the most common to the most rare TTP. With the help of computer software, LT profiling is performed for each organization depending on their TEA and determining priority measures for protection against current TTP in accordance with methods of counteracting used by groups of malefactors TTP, wherein the profiled list of threats is stored in database 1 and information security threats are prioritized for each organization.

EFFECT: more accurate determination of personalized threats to information security with respect to a specific organization.

6 cl, 9 dwg