RU2778635C1 - System and method for outside control of the cyberattack surface - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: method for outside control of the cyberattack surface includes the stages of obtaining information about the compromise indicators and the elements of the protected infrastructure and storing said information, detecting control points of the protected infrastructure, scanning the control points of the protected infrastructure and obtaining information on the statuses of the control points of the protected infrastructure, verifying the presence of compromise indicators in the information on the statuses of the control points, and, in response to detecting at least one compromise indicator, forming at least one warning of a possible cyberattack and transmitting at least one generated warning of a possible cyberattack.

EFFECT: prevention of compromise of the protected infrastructure by intruders or malware and timely information of the cybersecurity service about the detection of compromise attempts.

13 cl, 9 dwg

Description

FIELD OF TECHNOLOGY

[0001] The invention relates to the field of computer technology, namely to systems and methods for external control of the cyberattack surface.

[0002] An attack surface or a cyberattack surface in the context of this application is the totality of all potentially vulnerable hardware and software solutions present in the protected network infrastructure (such as, for example, ports open on a server and web services running on it), and as well as individual properties and parameters of these solutions (for example, SSL certificate and its validity period, server IP address and registration data of its owner, user account name and password, etc.).

[0003] Collectively, these potentially vulnerable solutions, as well as their properties and parameters, which are controlled by the claimed technology, will also be referred to as control points of the protected infrastructure within this description. In other words, the cyber attack surface consists of a set of control points of the protected network infrastructure.

[0004] The term network infrastructure itself is understood in the conventional sense within this specification; this is a combination of software and hardware that creates the basis for the effective exchange of information and can become the subject of interest of intruders (for example, an enterprise computer network containing servers, workstations, routers, etc.).

BACKGROUND OF THE INVENTION

[0005] The task of monitoring the state of the network infrastructure and warning about its possible compromise has been known for a long time.

[0006] For example, there is a whole class of solutions called vulnerability scanners that allow you to scan networks, computers, and applications for possible security problems. In this class of solutions, there are usually distinguished: port scanners, computer network topology research tools, network service vulnerability research tools, and script research tools (CGI scanners). However, all these solutions are aimed more at research activities than at preventing the compromise of some predetermined network infrastructure.

[0007] There are exceptions; for example, the SAINT vulnerability scanner (https://en.wikipedia.org/wiki/SAINT (software)) is known, which allows you to control a given network infrastructure and detect possible vulnerabilities. However, this solution, unlike the solution that will be described below, is designed to scan predefined infrastructure checkpoints. In addition, SAINT is based on the analysis of TCP and UDP services, and vulnerabilities such as leaked corporate email credentials are beyond its capabilities, which also distinguishes it from the solution described below.

[0008] Other solutions are known for monitoring the status of a predetermined network infrastructure.

[0009] Thus, the solution US 10,721,262 B2 "RESOUR.CE -CENTRIC NETWORK CYBER ATTACK WARNING SYSTEM" dated 10/13/2017 is known from the prior art. The solution can generate alerts related to a potential cyberattack on an organization's resource. To do this, it can obtain information about activity in the organization's computer network, access contextual information, determine one or more indicators of compromise based on the contextual information, and calculate a risk score, where the risk score indicates the likelihood that the resource is at risk of a cyberattack. In response to the fact that the risk assessment meets the threshold value, an appropriate alert is generated.

[0010] The difference between this known solution and the solution described below is that:

a. The known solution is not aimed at protecting the entire network infrastructure as a whole; the object of protection is some predetermined resource, for example, a database or a payment system.

b. The architecture of the known solution is internal; it is located inside the protected network infrastructure, and therefore requires integration work into the protected infrastructure.

c. The algorithm for calculating the risk assessment in the well-known solution is based on the use of the so-called. "contextual information", which includes data such as lists of users allowed to work with the resource, typical user scenarios, location of the resource in the topology of the protected network infrastructure, physical location, etc. At the same time, the proposed solution does not require such data to work.

[0011] Also known in the art is US Patent 10,778,701 B2 "Mitigating cyber-attacks by automatically coordinating responses from cyber-security tools", which describes a method for automatically coordinating responses from cyber-security tools. The cybersecurity engine may include software modules created from multiple sources, each of the software modules being designed to integrate a respective cybersecurity tool with the cybersecurity engine. The cybersecurity engine may use software modules to communicate with cybersecurity tools to detect one or more events indicative of a cyber attack on the computing environment. The cybersecurity mechanism can then define a coordinated response strategy involving collaboration between cybersecurity tools to reduce the effectiveness of a cyberattack.

[0012] The difference between the known solution presented in US 10,778,701 B2 and the solution to be disclosed below is that:

a. The known solution solves the problem of coordinating the actions of many independent and heterogeneous software modules, such as antivirus, firewall, etc., which requires the integration of such modules into this solution.

b. The mentioned software modules are located inside the protected network infrastructure.

c. The known solution does not have the ability to respond to those methods of compromising the protected network infrastructure, in the implementation of which the attacker first acquires legitimate credentials of one or more accounts and gains access to the network infrastructure as a legitimate user.

[0013] Also known from the prior art is the solution described in US 2016/0308898 A1 "Systems and methods for tracking, analyzing and mitigating security threats in networks via a network traffic analysis platform". The publication discloses a method for analyzing network traffic, which includes receiving information based on monitoring traffic at multiple levels on one or more monitors deployed in a network using deep packet inspection; obtaining information based on traffic monitoring at the end point of the network; analysis of monitored traffic from the endpoint and one or more monitors to determine the network infrastructure and the cybersecurity status of the network infrastructure; and providing visualizations based on network infrastructure and cybersecurity status for continuous monitoring of threats.

[0014] The difference between this known solution and the solution that will be disclosed below is that:

a. The well-known solution is aimed at analyzing only network traffic, so it does not have the ability to detect a compromise of the network infrastructure, which took place, for example, due to the preliminary acquisition of legitimate credentials by an attacker.

b. These monitors must be located within the protected network infrastructure.

[0015] In addition, US 10873597 B1, "Cyber attack early warning system", is known from the prior art. This solution discloses a method that involves obtaining data related to previously analyzed or known malicious attacks from a first network device. In addition, the first network device receives an attack warning associated with the object analyzed and identified as suspicious by the second network device. The attack alert includes information related to the suspicious object. In doing so, to generate alerts, at least a portion of the attack alert information is provided to a system configured to at least (i) extract a feature from an attack alert, (ii) determine similarities between the extracted features and features associated with previously analyzed or known malicious attacks to determine the outcome.

[0016] The difference between this known solution and the solution that will be disclosed below is that:

a. The known solution implies the presence of a specialized threat detection center (MCD), and the functioning of this center is based on the use of at least one virtual environment where suspicious files are checked.

b. The well-known solution is based on the analysis of network traffic, while the cyberattack surface of the protected network infrastructure within the known solution is not defined and controlled.

[0017] In addition, US 7,930,256 B2, "SECURITY SYSTEM FOR AND METHOD OF DETECTING AND RESPONDING TO CYBER ATTACKS ON LARGE NETWORK SYSTEMS" is known from the prior art. This solution includes: (a) an information retrieval subsystem based on a collection of so-called intelligent agents, configured to automatically search and retrieve relevant data from distributed sources; (b) a rule-based inference engine configured to interpret the extracted data in a situational context to support the generation of events and alerts for evaluating and predicting cyber threats; and (c) a threat assessment and prediction engine configured to capture the relationship between cyber sensor outputs and cyber attacks.

[0018] The difference between this known solution and the solution that will be disclosed below is that:

a. The known solution is based on data obtained from so-called intelligent agents; these agents reside within protected network infrastructures.

b. The well-known solution is a super-large system designed to analyze and prevent malicious activity on a national scale. The use of such a system in order to prevent compromise of the network infrastructure of any particular enterprise, even a very large one, is not disclosed in the description of the well-known solution.

[0019] At the same time, it should be noted that the use of any solution designed to work inside a protected network infrastructure, such as all the solutions described above in relation to the prior art, in practice necessarily implies the adoption of a number of organizational and technical measures. They are necessary to ensure not only the integration of the solution into the existing infrastructure, but also testing both the solution and the modified infrastructure for correct and uninterrupted functioning. But such measures are far from always possible, since quite often the owners of the network infrastructure impose strict requirements for information security and uninterrupted operation. As a result, neither temporary shutdown of any components of the network infrastructure, nor placement of additional equipment and programs inside the protected perimeter is allowed.

[0020] In such circumstances, the use of any solutions like those listed above in relation to the prior art, is extremely difficult.

[0021] The solution described below is designed to solve at least some of the problems identified in the analysis of the prior art.

DISCLOSURE (ESSENCE) OF THE INVENTION

[0022] The objective of the proposed invention is to develop a method and system for external control of the cyberattack surface.

[0023] The technical result of the claimed technology is to prevent the compromise of the protected infrastructure by intruders or malware, as well as timely informing the cybersecurity service about the detection of compromise attempts.

[0024] This technical result is achieved due to the fact that the method of external control of the cyber attack surface, performed by a computing device, contains steps in which information is obtained about indicators of compromise and elements of the protected infrastructure and save them, detect control points of the protected infrastructure, scan control points of the protected infrastructure and receive information about the statuses of control points of the protected infrastructure, check for the presence of indicators of compromise in the information about the statuses of control points, and in response to the detection of at least one indicator of compromise, at least one warning about a possible cyber attack is generated and at least one generated warning is transmitted warning of a possible cyber attack.

[0025] The technical result is also achieved due to the fact that the system of external control of the cyber attack surface, configured to exchange traffic with devices of the protected infrastructure, contains at least a communication module, an infrastructure detection module, a scanning module, an analysis module, an alert module, and an information storage module containing at least one database, as well as machine-readable instructions, which, when executed, ensure the implementation of the described method.

[0026] In a particular implementation, the method differs in that the basic information about the elements of the protected infrastructure includes at least one of the following:

• domain,

• IP address,

• SSL certificate,

• E-mail address,

• FTP server address,

• address of the database management system,

• the address of the file hosting web service,

• the name of the web service and the port on which it is running

[0027] In another particular implementation, the method is characterized in that the control points of the protected infrastructure include at least one of the following:

• domains,

• IP addresses,

• SSL certificates

• TLS certificates.

• names and version numbers of web services,

• a link to at least one web page to be checked for malicious code,

• a list of links to web pages containing high-risk content.

[0028] In another possible implementation, the method is characterized in that a graph model of the Internet is used to detect checkpoints of the protected infrastructure.

[0029] In another possible embodiment, the method is characterized in that when checkpoints of the protected infrastructure are detected, the protected infrastructure is additionally scanned.

[0030] In another possible implementation, the method is characterized in that the checkpoint statuses of the protected infrastructure include at least one of the following:

• Values of Domain Name System (DNS) resource records,

• The value of the Domain Name System entry containing the DMARC protocol settings,

• The name of the company that owns the IP address,

• Hosting provider IP address,

• The expiration date of the IP address,

• List of ports open on this IP address,

• List of network services running on this IP address,

• The name of the company that owns (org) the domain,

• Registrar (registrar) of the domain,

• Domain expiration date,

• Status of the SSL or TLS certificate,

• Parameters of an SSL or TLS certificate, namely the encryption algorithms that can be used by the server on which this certificate is installed.

• The validity period of the SSL or TLS certificate,

• The security status of the web page to be checked for malicious code,

• The length of the list of links to web pages containing high-risk content.

[0031] In another possible embodiment, the method is characterized in that the indicators of compromise also include at least one of the following:

• changing DNS data,

• incorrect functioning of the DNS,

• changing the owner of an IP address,

• change of the owner of a domain name,

• changing the status of an SSL certificate,

• changing the status of a TLS certificate,

• belonging of the used SSL encryption algorithms to the number of weak SSL encryption algorithms.

• belonging of the TLS encryption algorithms used to the number of weak TLS encryption algorithms.

• absence or incorrect setting of the DMARC protocol

• opening of a new port,

• launch of a new service,

• the absence of a running service in the list of known legitimate services,

• belonging of the version of the launched legitimate service to the number of known vulnerable versions,

• receiving, in response to a test request, from a legitimate web service, which is a DBMS or cloud storage, any other response, except for the "Authorization error" response,

• domain name expiration,

• expiration of the SSL certificate.

• expiration of the TLS certificate

• detection within the protected infrastructure of at least one web page with illegal content,

• detection of malicious code (such as an exploit, web shell, JS sniffer) on at least one web page of the protected infrastructure,

• detection of at least one call from at least one of the devices belonging to the protected infrastructure to at least one intruder's C&C server,

• detection of at least one intruder C&C server within the protected infrastructure.

[0032] In yet another possible implementation, the method is characterized in that DNS malfunction means at least one of the following:

• None of the DNS is responding.

• At least one of the DNS did not respond in time.

• At least one of the DNS has not declared itself authoritative.

• DNS SEC is not supported for this domain.

• The list of DNS provided by the root server (8.8.8.8) does not match the list published by DNS.

• There is only one DNS for this domain.

• Found at least one DNS that is able to answer any DNS lookup from any IP (Open Recursive Name Server).

• At least one DNS is an Open Zone Transfer Server and has provided information in the entire DNS zone.

• At least one DNS server has a private IP address

• No published DNS record found for the given domain or host name.

• More than one DNS is on the same class C subnet,

• DNS SOA expiration does not follow the recommended RFC.

• The DNS SOA cache value does not comply with the recommended RFC.

• The DNS SOA update value does not follow the recommended RFC.

• The DNS SOA retry value does not follow the recommended RFC.

• SOA serial numbers do not match.

• Incorrect DNS SOA serial number format.

[0033] In yet another possible implementation, the method is characterized in that information about leaks of confidential data is additionally obtained and stored.

[0034] In another possible implementation, the method is characterized in that it additionally checks for the presence of confidential data of the protected infrastructure in the information about leaks of confidential data, and in response to the detection of at least one case of leakage of confidential data of the protected infrastructure, at least one warning about a possible cyber attack,

[0035] In another possible implementation, the method is characterized in that the confidential data of the protected infrastructure includes at least one of the following:

• credentials of protected infrastructure users,

• personal data of protected infrastructure users,

• contact details of protected infrastructure users,

• payment data of protected infrastructure users,

• confidential information stored on protected infrastructure devices

[0036] In yet another possible implementation, the method is characterized in that at least one generated cyber attack warning is transmitted via at least one of the following communication methods:

• email (e-mail),

• SMS,

• MMS,

• push notifications,

• messages in the instant messaging program,

• API events

BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this specification, show embodiments of the invention and, together with the description, serve to explain the principles of the invention.

[0038] The claimed invention is illustrated by the following drawings, in which:

[0039] FIG. 1 shows an example of a functional diagram of a computing device implementing the described method.

[0040] FIG. 2A illustrates a flow diagram of a method for external monitoring of a cyberattack surface.

[0041] FIG. 2B illustrates a flowchart of one of the steps of the method for externally monitoring the cyberattack surface.

[0042] FIG. 3A illustrates an example of a fragment of a graph model of the Internet used in one of the stages of the method of external control of the cyber attack surface.

[0043] FIG. 3B illustrates an example of a filtered fragment of the graph model of the Internet, obtained at one of the stages of the method of external control of the cyber attack surface.

[0044] FIG. 3B illustrates an example of a filtered fragment of a graph model of the Internet, further enriched at one of the stages of the method of external control of the cyber attack surface.

[0045] FIG. 4A illustrates a flowchart for checking for indicators of compromise.

[0046] FIG. 4B illustrates a block diagram of another possible algorithm for checking for indicators of compromise.

[0047] FIG. 5 illustrates a simplified schematic representation of one of the non-limiting implementations of a computing device for implementing the present technical solution.

IMPLEMENTATION OF THE INVENTION

[0048] Exemplary embodiments of the claimed invention will be described below.

[0049] Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The gist of the description is nothing but specific details provided to assist a person skilled in the art in a thorough understanding of the invention, and the present invention is defined only within the scope of the appended claims.

[0050] To implement the described method of external control of the cyber attack surface, the computing device (100) is preliminarily installed, as shown in FIG. 1 outside the network infrastructure to be protected (180). The design and hardware configuration of this computing device can be any well-known, allowing the implementation of the functions described below. This may be, by way of example, but not limited to, a server. As an exemplary embodiment, for example, a Dell™ PowerEdge™ server can be mentioned. In an alternative implementation, the computing device (100) may be a cloud solution, ie a collection of servers. In yet another alternative implementation, this may be a mobile device such as a smartphone or tablet. But in any case, this device must be capable of exchanging traffic with devices of the protected infrastructure via a computer network, for example, via the Internet (170).

[0051] As part of the functional diagram of the specified computing device, the following functional modules should be provided: a communication module (110), an infrastructure detection module (120), a scanning module (130), an analysis module (140), an alert module (150), and also information storage module (160).

[0052] The listed modules, from the point of view of their technical implementation, can be software modules executing on a single computing device, software and hardware modules, for example, at least some of these modules can be implemented as dedicated servers, each of which performs a corresponding function, or represent an arbitrary combination of the above methods of implementation.

[0053] In this case, the main function of each of the modules is as follows:

[0054] The communication module (110) is configured to communicate with the infrastructure detection module (120), the scanning module (130), the notification module (150), and the information storage module (160). The communication module (110) enables communication of the computing device that implements this method with a computer network, for example, with the Internet (170). In turn, by means of a computer network, the communication module provides communication of the computing device (100) that implements this method with devices of the protected infrastructure (180). In addition, via the computer network, the communication module (110) provides the computing device (100) with the possibility of obtaining additional information, in particular indicators of compromise. The implementation of these functions by the communication module (110) has no special features and can be performed in any well-known manner.

[0055] The infrastructure discovery module (120) is configured to communicate with the communication module (110) and the information storage module (160). The infrastructure discovery module (120) provides for the search and identification of those control points that make up the cyberattack surface of the protected network infrastructure (180). Such checkpoints, as used herein, include at least domain names, IP addresses, SSL and TLS certificates, open port numbers, and the names and version numbers of web services running on those ports. One example of the possible implementation of these functions by the infrastructure discovery module (120) will be described below with reference to the drawings of FIG. 2A-B. and Fig. 3A-B.

[0056] The scanning module (130) is configured to communicate with the communication module (110) and with the data storage module (160). The scanning module (130) is also configured to scan devices of the protected network infrastructure (180) and obtain information about web services running on the ports of these devices. The scanning module (130) provides scanning of control points of the protected network infrastructure and obtaining information about their status, that is, parameters characterizing the current state of the control points. If the breakpoint is a domain name, say, company.com, then information about the statuses of such a checkpoint may include, as a non-limiting example, at least: the IP address to which this domain name is mapped (resolve), at least one DNS corresponding to this domain name, the name and version number of software (web services) operating on the server that has this domain name, the name of the owner of the domain name (registrar), his address, contact phone number, his e-mail address, the date of registration of the domain name, the date of expiration of the registration of the domain name, the current status of the domain name (for example, "active"), as well as the date of the last change of all listed parameters. The implementation of these functions by the scanning module (130) has no special features and can be performed in any well-known way.

[0057] The analysis module (140) is configured to communicate with the scanning module (130), the information storage module (160), and the notification module (150). The analysis module (140) checks the information received from the scanning module (130) about the status of the control points of the protected network infrastructure (180) for the presence of vulnerabilities, insecure settings and other indicators of compromise in it. The implementation of these functions by the analysis module (140) has no special features and can be performed in any well-known way.

[0058] The notification module (150) is configured to communicate with the analysis module (140) and with the communication module (110). The notification module (150) provides for the formation and transmission, by means of the communication module (110), of notification of a possible compromise of the protected network infrastructure in at least one of the following ways: by e-mail, by sending SMS, by sending MMS, by sending a push notification, message in an instant messaging program by raising an API event. The implementation of these functions by the notification module (150) has no special features and can be performed in any well-known manner.

[0059] The information storage module (160) is configured to communicate with the communication module (110), the infrastructure discovery module (120), the scanning module (130), and the analysis module (150). The information storage module (160) provides information storage, both permanent and temporary. To do this, the information storage module (160) contains at least one database (not shown in Fig. 1), which allows you to store information in an orderly manner and efficiently search. Also, the information storage module (160) can store program instructions, the execution of which ensures that the device (100) implements the described method. The implementation of these functions by the information storage module (160) has no special features and can be performed in any well-known manner.

[0060] Next, with reference to FIG. 2A, the main steps of a method (200) for external monitoring of a cyberattack surface will be described.

[0061] The method (200) begins at step (210) when basic information about the elements of the protected infrastructure is obtained, by means of the communication module (110), and stored in the database of the information storage module (160).

[0062] Basic information about the elements of the protected infrastructure in this case can be at least one of the following: a domain or IP address related to at least one website that is part of the protected infrastructure, at least one SSL- a certificate installed on at least one such site or on at least one IP address, an e-mail address related to a mail service operating in the protected infrastructure, for example, a corporate e-mail address. In addition, the basic information may include pointers, such as links, to data stores present in the protected infrastructure, in one non-limiting example, this may be: FTP servers, database management systems such as MongoDB, file hosting web services , such as AWS bucket storages, and so on. Additionally, information about the protected infrastructure may include addresses, identifiers, and version numbers of web services operating in the protected infrastructure.

[0063] The address of the web service in this case is the IP address of the server and the port number on which this web service is running. The service identifier can, without limitation, be either the name of a web service, such as Apache Tomcat, or a convention, such as a pre-assigned serial number of a web service, or a number resulting from taking a hash function, for example, from a character string of the web service name. The web service version number is a traditional software version number used in the IT industry.

[0064] So, as an example, at step (210), the company.com domain could be obtained as basic information about the elements of the protected infrastructure.

[0065] In addition, at step (210) receive, through the communication module (110), information about indicators of compromise and store them in the database of the information storage module (160).

[0066] It should be noted that within the framework of this description, the concept of an indicator of compromise is interpreted wider than the generally accepted meaning. In addition to artifacts that directly indicate the fact of a compromise (for example, the presence in the system registry of an entry characteristic of a known malicious program), within the framework of this description, indicators of compromise also include the values of checkpoint statuses that indicate a change in the state of a given checkpoint.

[0067] For example, indicators of compromise also include: changing DNS data, changing the owner of an IP address, changing the owner of a domain name, changing the status of an SSL certificate, changing the status of a TLS certificate, opening a new port, starting a new service, expiration of a domain name, SSL certificate expiration, TLS certificate expiration, absence of the name of the detected software (web service) in the list of legitimate software, if the version of the legitimate software (web service) used is among the known vulnerable versions of this service , the absence or incorrect configuration of the DMARC protocol, the use of weak encryption algorithms in SSL / TLS, and the leakage of confidential data.

[0068] Confidential data, in turn, means at least: credentials of users of the protected infrastructure, personal data of users of the protected infrastructure, contact data of users of the protected infrastructure, including business email addresses, payment data of users of the protected infrastructure, as well as other confidential information stored inside the perimeter of the protected infrastructure, for example, databases, file storages, network shared folders, etc.

[0069] However, the indicators of compromise obtained at step (210) are exactly the objects or artifacts, the detection of which in the infrastructure may indicate its compromise. They can be, for example, hash sums of malicious files, names of malicious files and paths where they are located, IP addresses of malware command and control servers accessed by one of the protected infrastructure devices, addresses of DNS servers used by malware and so on.

[0070] In addition, along with such objects, indicators of compromise obtained at this stage may also include information about leaks of confidential data, for example, information about the names of companies whose illegal access to the infrastructure was put up for sale on specialized forums used by cybercriminals, as well as information about the accounting, personal, payment data of employees of such companies put up for sale.

[0071] Technically, such indicators of compromise may be, for example, lists stored in text files, or otherwise ordered data structure, such as a separate database, implemented in any well-known format.

[0072] All of the above information can be collected in advance from any suitable source, for example, from open third-party sources of cyber intelligence data (Threat Intelligence feeds), from the results of analysis of traffic or code of malicious files, performed, for example, by a third-party platform for detonating malicious files or a virtual environment , sandbox, third-party code analysis tools for malicious files, etc. Such information can enter the system that implements the method (200) once, at the first stage (210) of its operation. In one alternative implementation of the system, information about indicators of compromise is received and stored in the database of the information storage module (160) at a predetermined frequency, for example, once a day, or, for example, every four hours.

[0073] The steps performed by the method (200) in step (210) are non-specific and may be performed in any conventional manner.

[0074] At the end of step (210), the method (200) proceeds to step (220), where the checkpoints of the protected infrastructure (180) are detected through the infrastructure discovery module (120), namely, domain names, IP addresses, SSL and/or TLS certificates.

[0075] In one of the possible embodiments of the described method, the basis of the infrastructure discovery module (120) can be a pre-built graph model of the Internet. Below, with reference to FIG. 3A, a non-limiting example will be given of how, in one possible implementation, a graph model of the Internet can be built. It should be noted that this is a simplified example given for ease of understanding, so it does not conventionally show a number of graph vertices that may be present in the practical implementation of such a model.

[0076] The graph model of the Internet (300) is a graph, at the vertices of which there are elements of the infrastructure of computer networks and the parameters of these elements. Elements of the infrastructure of computer networks can be involved such as, for example, IP addresses (310), (320), (330), (340), domains (311), (315), (319), (323), (325 ), ports (312), (316), (332), web services running on these ports (314), (318), (334), SSL and TLS certificates (313), (317), (321 ) etc. The parameters of the infrastructure elements of computer networks can be, for example, the owners of IP addresses (302), (342), the dates of registration of IP addresses (not shown), the dates of creation and expiration of SSL and TLS certificates (not shown), etc. .

[0077] The vertices of the graph are identified at the stage of building the model during the scanning of the Internet. This scan allows you to obtain information about the existence, status and parameters of each of the listed elements of the computer network infrastructure.

[0078] The edges of the graph are the links identified during the analysis of the results of the said scanning of the Internet. In this case, a connection is considered to be the revealed coincidence of the parameters of different elements of the infrastructure of computer networks. Building links between nodes can be performed in any well-known manner, for example, as described in patent RU 2681699, where at least the first network resource (one graph node) and at least the second network resource (another graph node) are found; extracting information about the found network resources, including at least one parameter of the first network resource and at least one parameter of the second network resource; and in response to the fact that at least one parameter of the first network resource matches at least one parameter of the second network resource, a link is built between the first network resource and the second network resource (an edge between two graph vertices).

[0079] Thus, with reference to FIG. 3, links between graph nodes corresponding to IP addresses (320), (330), and (340) are established because these three addresses belong to the same owner (342). Links between nodes corresponding to domains (315), (319) and (325) are established because the same SSL certificate (317) is installed on the websites having these domain names.

[0080] In addition, links between nodes corresponding to domains (315) and (319) are established because both of these domain names refer (resolve) to the same IP address (310). Similarly, links between nodes corresponding to domains (323) and (325) are established because both of these domain names refer to the same IP address (320).

[0081] The connection between the graph vertices corresponding to the port (316) opened at the IP address (310) and the port (332) opened at the IP address (330) is established because the same web services are running on these ports (318 ), (334), for example, Apache Tomcat web servers of the same version v.3.3.2.

[0082] Each edge of the graph (each connection) in the graph model of the Internet network (300) can be assigned a certain weight characterizing, for example, the "strength" of this connection or some other parameter of it. The calculation or assignment of these values can be performed in any well-known way. In one non-limiting example, a link may have more weight the fewer elements it connects; for example, the association between an IP address (310) and the owner of that address (302) may carry more weight than the associations between IP addresses (320), (330) and (340) and their owner (342).

[0083] In addition, the weight assigned to each edge of the graph may depend on other parameters. For example, links built from nodes that correspond to SSL certificates may carry more weight than links built from nodes that correspond to the same web services, such as web services (318), (334). Any other known methods of calculating or assigning weights to the edges of such a graph are possible, without limitation.

[0084] The above-described graph model of the Internet can be made with the possibility of periodic replenishment or enrichment. Replenishment or enrichment of the graph model can be performed both by rescanning the Internet and analyzing the data obtained in the manner described above, or by alternative methods, for example, described below.

[0085] In one non-limiting example, lists of domains published by domain registrars can be analyzed and thus new domains can be identified. In another example, network traffic on the Internet can be analyzed and new domain names extracted from it. In another example, new domains can extract from these SSL certificates, as well as from the code or traffic of malicious files analyzed by third-party systems. Similarly, they can analyze the lists of issued SSL and TLS certificates, thus obtaining information about new certificates and domains, and replenishing the graph model. Said analysis of lists, network traffic, malicious file code, and certificates can be performed in any well-known manner.

[0086] The graph model of the Internet network, created in advance and constantly updated in this way, is included in the infrastructure discovery module (120), through which at step (220) the control points of the protected infrastructure (180) are identified, namely the domain names related to it, IP- addresses, SSL and/or TLS certificates, open ports and web services running on these ports.

[0087] The main steps of step (220) are shown in FIG. 2B. Step (220) begins at step (222), where the basic data about the elements of the protected infrastructure (180) obtained at step (210) is found in the graph model of the Internet network.

[0088] In the example above, such master data is the (311) company.com domain. At step (222), the indicated domain (311) company.com is found in the graph model of the Internet by any well-known method.

[0089] Then go to step (224), which reveals a fragment of the graph model containing all the elements, one way or another related to the domain (311). In one of the non-limiting embodiments of the method, all elements of the graph model are taken for this, with which the domain (311) has any connection. In another possible implementation, those elements are taken that are connected to the original element of the protected infrastructure by such a number of edges that does not exceed a predetermined threshold, for example, elements connected to the original element of the protected infrastructure by no more than 500 edges (links). The identified fragment of the graph model may look, for example, as shown in Fig. 3A.

[0090] Then proceed to step (226), where at least one cleaning algorithm is applied to the identified graph fragment. This at least one algorithm may, without limitation, be at least one of any algorithm known in the art. In one non-limiting example, this may be an algorithm that cuts off graph edges (connections) whose weight is less than a predetermined threshold value.

[0091] As a result of applying at least one cleaning algorithm in step (226), a cleaned fragment of the graph is obtained. An example of such a purified fragment (350) is shown in FIG. 3B. It can be seen from the drawing that as a result of performing steps (222) - (226) in this example, two additional domains, (315) and (319), two SSL certificates (313) and (317), an IP address (310 ) server 111.222.333.444 and the addresses of two ports open on this server, on which network services are running: port 111.222.333.444:69 (312), on which the Cisco TFTP Server v.1.1 FTP server (314) is running, and port 111.222. 333.444:8080 (316) running the web server (318) Apache Tomcat v.3.3.2.

[0092] Then, at step (228), the identified elements of the protected infrastructure are additionally scanned by means of the scanning module (130). This is done in order to obtain the most complete information about the composition of the protected infrastructure. This scan of the protected infrastructure can be performed one or more times. It is performed in exactly the same way as the scan described below with respect to step (230).

[0093] The result of this scan may be an additional enrichment of the cleaned fragment of the graph model of the Internet with the data obtained during the scan.

[0094] For example, as shown in FIG. 3C, as part of the enriched cleaned fragment of the graph model of the Internet (360), the port 111.222.333.444:22 (362), port 111.222.333.444:443 (364) and port 111.222.333.444:50050 (366) identified during additional scanning appeared . This drawing also illustrates the fact that it was possible to identify open ports, but the names and versions of the web services running on these ports remained unknown.

[0095] In one of the possible embodiments of the described method, additionally at step (228), by means of the infrastructure discovery module (120), web pages to be analyzed and controlled, related to the domains of the protected infrastructure, can be detected. To do this, for each domain identified in the protected infrastructure, at least one web page related to this domain is obtained, and the content of this at least one web page is analyzed.

[0096] Actually obtaining at least one web page can be performed in any well-known way. In one non-limiting example, this step may involve the use of any well-known utility that, given a given domain name, builds a list of web pages associated with that domain name, such as the SiteAnalyzer utility. In another non-limiting example, any of the well-known crawling algorithms (revealing related web pages) can be used. In another non-limiting example, a list of web pages to be analyzed and controlled can be obtained in advance by the system implementing the described method and stored in the database of the information storage module (160).

[0097] The analysis of the identified web pages is performed in two phases. During the first phase, the nature of the content (content) placed on each web page is analyzed and the categories of content to which the analyzed web pages belong are identified. This may be done in any well known manner.

[0098] As a non-limiting example, this can be done by the method described in patent RU 2738335. In accordance with this method, a pool of web pages is preliminarily formed, moreover, so that the pool includes web pages in sufficient quantity, the content of which relates to to each of the categories requiring control, for example, such as "authorization", "payments and transfers" (that is, pages intended for entering confidential data), "adult content", "gambling", "drugs" (pages containing high-risk content), "business", "medicine", "leisure", and so on (pages of all other types). Then the content of web pages is converted from HTML to text, the text is tokenized, a matrix of tokens is formed for training an ensemble of classifiers, and based on the obtained matrix of tokens, an ensemble of classifiers is created, and for each of them a decisive priority is predetermined. At the same time, text tokenization implies the exclusion of punctuation from it, the conversion of all letters to lower case, the conversion of all words to their original form, symbolic and statistical processing of natural language and morphological analysis.

[0099] In the future, to assign an arbitrarily taken web page to one of the categories on which the ensemble of classifiers was trained, the content of this web page is converted from HTML to text, the text is tokenized, receiving a vector of tokens, and the resulting vector of tokens is fed to the input of the trained ensemble of classifiers. In accordance with the decision of the ensemble of classifiers, a web page is assigned to one of three categories:

• web pages intended for entering personal, accounting or other confidential data,

• web pages containing adult content, content related to gambling and other high-risk content,

• all other web pages.

[0100] During the second phase of the analysis, web pages categorized as "all others" are not considered.

[0101] A link to each of the web pages categorized as "pages for entering confidential data" is considered a separate control point. Information about such checkpoints is stored, for example, in the form of a URL, in the database of the information storage module (160). At the same time, in the database it is possible, without restrictions, any rubrication of such saved links, for example, the presence of a special mark "page for entering confidential data".

[0102] All links to web pages categorized as "pages with high risk content" are stored, for example, as a list of URLs, in the database of the information storage module (160), and consider this list as another checkpoint.

[0103] In one of the possible embodiments of the described method, additionally at step (228), other web pages to be checked for malicious code can also be detected by means of the infrastructure detection module (120). In particular, they can detect web pages that may have a so-called web shell.

[0104] To identify pages where a web shell is possible, for each of the domains belonging to the protected infrastructure, they check for the presence of special folders that are likely to contain such pages, such as the /wp-content/ folder, the / just7z/, and so on. Actually, the names of the special folders, the existence of which is to be checked in relation to the discovery of web shells, are well known to experts in the subject area. These names may be previously stored in a separate list in the database of the information storage module (160).

[0105] If there is at least one of these folders, for example, the /wp-content/ folder, it is checked, by means of the infrastructure detection module (120), that this folder contains at least one file that is likely to contain malicious code, for example , any of the files wso2.5.1.php, wso2.5.php, wso2.php, wso.php, and so on. The names of such files are well known to experts in the subject area; they may also be previously stored as a separate list in the database of the information storage module (160).

[0106] The actual detection of a file with a given name within a given folder can be performed in any well-known manner. In response to the discovery of each such file, a link, for example, a URL, to this file is received.

[0107] A link to each of the found files (web pages) categorized as "pages possibly containing a web shell" is considered a separate checkpoint. Information about such checkpoints is stored, for example, in the form of a URL, in the database of the information storage module (160). At the same time, in the database it is possible, without restrictions, any rubrication of such stored links, for example, the presence of a special mark "web shell".

[0108] For example, during the described check on one of the site3.company.com domains related to the protected infrastructure, the /wp-content/ folder can be found, and inside this folder, a web page named wso2.php. In this example, the following link will be stored in the database of the information storage module (160) marked "web shell":

[0109] http://site3.company.com/wp-content/wso2.php

[0110] All checkpoints detected as a result of step (220), that is, domains, IP addresses, SSL and TLS certificates, open ports, names and versions of running web services of the protected infrastructure (180), as well as checkpoints, which are links to web pages, the system implementing the method (200) saves in the database of the information storage module (160). Thereafter, method (200) proceeds to step (230).

[0111] At step (230), the checkpoints of the protected infrastructure (180) detected in the previous step are scanned by means of the scanning module (130) and receive, also by means of the scanning module (130), information about the statuses of the checkpoints of the protected infrastructure.

[0112] The statuses of control points of the protected infrastructure in this case include at least:

[0113] The values of the Domain Name System (DNS) resource records, namely the initial zone record (SOA) and the Name Server (NS) record. However, it is possible to implement the described method in which the values of other types of resource records are also used, that is, obtained and subsequently controlled, for example, without limitation, resource records of types A, CNAME, MX, TXT and SPF.

[0114] In particular, in one of the possible implementations of the described solution, resource records of the TXT type are obtained that specify the configuration of the DMARC protocol. Such records can be distinguished from other resource records of the TXT type by the presence of a combination of characters in the record text.

[0115] v=DMARC1

[0116] In general, in order to obtain the values of DNS resource records, use information about the domains that are part of the protected infrastructure and discovered as a result of step (210). For each domain, a list of DNS servers used by this domain is determined, and then, for each DNS server, the values of resource records related to this domain are obtained and the result is stored in the database of the information storage module (160). All of the listed actions can be performed in any well-known way, for example, using the dig utility or the Whois service in any of their implementations.

[0117] Registration parameters for each of the detected domains of the protected infrastructure: domain owner, domain registrar, domain expiration date.

[0118] In order to obtain the values of these parameters, use information about the domains that are part of the protected infrastructure and discovered as a result of step (210). For each domain, in any well-known way, for example, through the Whois service, the specified values are obtained and the result is stored in the database of the information storage module (160).

[0119] Parameters of certificates installed on each of the domains and IP addresses of the protected infrastructure. For each of the domains and IP addresses, determine the status of its SSL certificate or TLS certificate (the status indicates whether the certificate is valid), the validity period of the SSL certificate or TLS certificate, and encryption algorithms that can be used by the server on which this certificate is installed. .

[0120] In order to obtain the values of these parameters, use information about the domains and IP addresses that are part of the protected infrastructure and discovered as a result of step (210); actually obtaining certificate parameters can be performed in any well-known way, for example, using the openly available OpenSSL library or by generating a GET request to an open online service, such as www.sslshopper.com, and parsing (parsing) the response text received from this online -service.

[0121] In this case, among other things, the response of the server on which a certain certificate is installed, for example, a TLS certificate, will contain codes of supported encryption algorithms. They might look like this, for example:

[0122] TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

[0123] Subsequently, by analyzing such codes, the system implementing the described method can determine whether the encryption algorithms that the domain or server supports with this installed certificate are weak.

[0124] Registration parameters for each of the detected IP addresses of the protected infrastructure: the owner of the address, the hosting provider, the expiration date of the IP address.

[0125] In order to obtain the values of these parameters, use information about the IP addresses that are part of the protected infrastructure and discovered as a result of step (210). For each IP address, by any well-known method, for example, through the Whois service, the specified values are obtained and the result is stored in the database of the information storage module (160).

[0126] The activity parameters of each of the detected IP addresses of the protected infrastructure: a list of ports open on this IP address, as well as a list of web services running on ports of this IP address and the software version corresponding to these web services.

[0127] In order to obtain a list of open ports, as well as the names and versions of services running on them, use information about the IP addresses that are part of the protected infrastructure and discovered as a result of step (210). Moreover, the so-called port scanner is used, that is, a software implementation of an algorithm built, for example, on the principles of SYN, TCP, UDP, ACK or FIN-scanning, or on any other well-known port scanning principles that make it possible to distinguish an open port from a closed one.

[0128] For each IP address, using a pre-prepared script or online service (such as, for example, nmap.org), a list of currently open ports on this IP address is obtained, as well as the names (identifiers) and versions of those running on them web services and store the result in the database of the information storage module (160). Actually obtaining this information is a well-known, standard function of port scanners. The port scanner responses determine not only the numbers of open ports, but also the names and versions of programs (web services) running on them.

[0129] In another possible implementation of the described method, well-known network utilities that are included with some operating systems, such as the netstat and nmap utilities, are used to determine the state of the ports.

[0130] Security settings of websites of the protected infrastructure: the presence on the websites of the protected infrastructure of at least one web page with illegal content, as well as the presence of malicious code on some web pages, such as pages intended for input confidential data.

[0131] Links to web pages categorized as "pages with high risk content" in step (220) were stored, for example, as a list of URLs, in the database of the information storage module (160). This list is considered a checkpoint, the status of which is the length of the list: the zero length of the list is considered an indication that there are no pages with high-risk content (gambling, adult content, drugs, etc.) in the protected infrastructure. A non-zero list length, on the contrary, is considered an indication of the presence of at least one link to a similar page within the protected infrastructure.

[0132] A checkpoint is also considered each of the links to a page that may contain malicious code. At step (230), each of these links is checked, by means of the analysis module (140), and based on the results of the check, it is assigned an appropriate security status indicating the presence or absence of malicious code on this web page.

[0133] When checking pages categorized as "pages possibly containing a web shell", each of these pages is loaded in the browser, and then checked, by means of the analysis module (140), the page code using pre-prepared and stored in the database an information storage module (160) of signatures, such as YARA rules, for example, designed to detect known web shells. Such signatures, including YARA rules, are well known to experts in the subject area. Said verification is also well known to those skilled in the art; it can be performed in any well-known way.

[0134] In this example, when checking a file located by reference

[0135] http://site3.company.com/wp-content/wso2.php

[0136] one of the YARA rules, such as:

[0137] the presence of a web shell in this file will be detected. As a result of this check, the status "Malware detected" will be set for this checkpoint.

[0138] Otherwise, if the web shell had not been detected, the checkpoint corresponding to this page would have been set to "Page secure".

[0139] Similarly, when checking pages categorized as "pages for entering confidential data", each of these pages is loaded in the browser, the scripts included in the page are found, decoded, and then checked, by the analysis module (140), script code using signatures prepared in advance and stored in the database of the information storage module (160), designed to detect known JS sniffers and exploits. Such signatures are well known to those skilled in the art. This page analysis procedure is also well known to those skilled in the art; it can be performed in any well-known way.

[0140] In exactly the same way, as a result of checking pages in the script code of which a JS sniffer or exploit was detected, the checkpoint corresponding to this page is set to the status "Malious code detected". In the event that neither a JS sniffer nor an exploit were detected, the checkpoint corresponding to this page is set to the "Page safe" status.

[0141] All information received during the execution of step (230) about the status of control points of the protected infrastructure (180) is stored by the system that implements the method (200) in the database of the information storage module (160). It should be noted that, technically, each checkpoint status could be, for example, a string of characters stored in a text format file. Alternatively, each status may be an entry in a database. At the same time, in addition to the status value itself, this record can also store additional information, for example, an indication of the type or type of checkpoint to which this status belongs: DNS data, certificate information, IP address information, etc. In other words, in the database it is possible, without restrictions, any rubrication of the statuses of control points according to their types, varieties, dates and times of receipt, etc.

[0142] Thereafter, method (200) proceeds to step (240).

[0143] At step (240) check, by means of the analysis module (140), the communication module (110) and the database of the information storage module (160), the presence of indicators of compromise in the information about the statuses of control points. Moreover, in response to the detection of at least one indicator of compromise, at least one warning about a possible cyber attack is generated and transmitted by means of the notification module (150) and the communication module (110).

[0144] The execution of step (240) will be described in more detail below with reference to FIG. 4A and FIG. 4B.

[0145] It should be noted that the checks performed during step (240) may differ from those shown in FIG. 4A and FIG. 4B sequences, that is, the actions performed in accordance with FIG. 4A may be performed prior to the actions performed in accordance with FIG. 4B, and after them, and simultaneously with them.

[0146] It should also be mentioned that for ease of understanding in FIG. 4A and FIG. 4B does not show a complete set of possible checks, but only illustrative non-limiting examples. The full range of checks to be carried out can be, in accordance with this description, much wider than shown in the above drawings.

[0147] So, step (240) can begin at step (242), which receives, by means of the analysis module (140), from the list of checkpoint statuses previously stored in the database of the information storage module (160), obtained during the execution of the step (230), the next checkpoint status.

[0148] Then, at step (244), a type of check is selected, which depends on what the given checkpoint is, whether it is DNS data, domain, IP address, and so on. Since all checkpoint statuses, as described above in relation to step (230), are categorized into checkpoint types when stored in the database, this choice of checkpoint type is purely formal and can be done in any well-known way.

[0149] So, if the status of the checkpoint (246) is DNS data, the name of the owner of the IP address, the owner of the domain, the status of the SSL or TLS certificate, then it is checked (248) for the fact that this status has changed. It can be performed in any well-known way, for example, by comparing the current and previous temporal values of a given status, where the previous temporal value is also obtained from the database of the information storage module (160) by means of the analytical module (140).

[0150] For example, at step (242) at 20.20 on January 18, 2020, we received the status of a control point, according to which the owner of the IP address 111.222.333.444 is Company, Ltd. At step (248), by means of the analytical module (140), a query is made to the database, the previous value of the same status is obtained, and it is found that, in accordance with the previous status of this checkpoint, received at 10.10 on January 17, 2020, the owner of this IP- The address was also Company, Ltd. Thus, the check in step (248) showed that the status of the "owner of IP address 111.222.333.444" checkpoint has not changed. Therefore, it is considered that no indicator of compromise has been found, and the method returns to step (242), where the next status is obtained.

[0151] In another example, at step (242) at 20.20 on January 18, 2020, a checkpoint status was obtained, according to which the site3.company.com domain is owned by Badguys, Ltd. At step (248), a database query is built using the analytical module (140), the previous value of the same status is obtained, and it is found that, in accordance with the previous status of this checkpoint, received at 10.10 January 17, 2020, the owner of this domain was company, ltd. Thus, the check in step (248) showed that the status of the "site3.company.com domain owner" checkpoint has changed, which is an indicator of compromise. Therefore, the method proceeds to step (250), where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to step (242).

[0152] Further, if the checkpoint status (252) is an open port on a given IP address, or a service running on that port, then it is checked (254) that the port or service is new. It can be performed in any well-known way, for example, by comparing the current and previous temporal values of a given status, where the previous temporal value is also obtained from the database of the information storage module (160) by means of the analytical module (140).

[0153] For example, at step (242) at 20.20 on January 18, 2020, a checkpoint status was obtained, according to which there is an open port 8080 on the IP address 111.222.333.444. At step (254), a query is built using the analytical module (140) to the database, get the previous value of the same status and find that, in accordance with the previous status of this checkpoint, received at 20.20 on January 17, 2020, port 8080 was also open on this IP address. Thus, the check in step (254) showed that the checkpoint status "port 8080 is open on IP address 111.222.333.444" did not change. Therefore, it is considered that no indicator of compromise has been found, and the method returns to step (242), where the next status is obtained.

[0154] In one of the possible alternative implementations of the described method, if at step (252) an open port is detected, at step (254) this port is also checked for belonging to a list of ports previously stored in the memory module database (160), the discovery of which is considered an indicator of compromise. In this implementation, by means of the analytical module (140), a query is made to the database, a list of ports is obtained, the opening of which is considered an unconditional indicator of compromise, and it is checked whether the detected open port is present in this list. The fact that a port, such as port 4899, is on the list is considered an indicator of compromise. Therefore, the method proceeds to step (250), where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to step (242).

[0155] In another example, at step (242) at 20.20 on January 18, 2020, a checkpoint status was obtained, according to which there is an open port 8443 on the IP address 111.222.333.444. At step (254) through the analytical module (140) build a query to the database, get the previous value of the same status in time and find that, in accordance with the previous status of this checkpoint, received at 20.20 on January 17, 2020, there was no open port 8443 on this IP address. Thus, checking at step (254) showed that the checkpoint status "port 8443 is open on IP address 111.222.333.444" has changed, which is considered an indicator of compromise. Therefore, the method proceeds to step (250), where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to step (242).

[0156] It should be noted that an attacker, having gained access to a legal infrastructure, can, in particular, install a malicious code management system in it, or a proxy server that allows you to forward (proxy) requests from malicious code to some other server belonging to attacker. Due to such proxying, the attacker hides the address of the real malicious server, and the malware interacts with a legitimate and trusted infrastructure, which greatly complicates its detection. The common name for this kind of web services is the command and control server or C2 server (command and control server).

[0157] It should also be noted that most of the existing C2 servers are well known to experts in the subject area, in particular, the ports that prefer to use these programs, the traffic encryption algorithms they use, as well as various features of their operation, up to characteristic errors, are known, identified for specific versions of a particular C2 server.

[0158] In one of the possible implementations of the described method, if the status of the checkpoint is an open port, and the name of the web service running on it is unknown, then in relation to this web service, by means of the analytical module (140), a check (on Fig. 4A not shown) that this web service is not a C&C server for intruders.

[0159] Within the framework of the example described above, such a check can be performed on all of those shown in FIG. 3On ports for which it was not possible to determine the name of the running web service, that is, ports 111.222.333.444:22 (362), 111.222.333.444:443 (364) and 111.222.333.444:50050 (366).

[0160] In an alternative implementation of the described method, such a check can be performed on only those open ports that are present in the list of ports used by known C2 servers. This list may also contain the names of the respective C2 servers and a list of the features of each of the C2 servers. All this information refers to well-known in the subject area; such a list may be prepared in advance and stored in the database of the memory module (160).

[0161] With regard to the above example, the analysis module (140) checks for the presence of ports 22, 443 and 50050 in the list of ports used by known C2 servers. As a result, it is determined that only one of these ports, namely 50050, is present in the list, and information is obtained from the list that port 50050 is often used by Cobalt Strike Team Server (a pentesting software product also popular with attackers). In such a case, the steps below are performed for that port only.

[0162] Checking that the web service running on port 50050 is not an intruder's command and control server is performed by sending, through the communication module (110), a typical HTTP request to this port, and subsequent analysis, through the analytical module (140), the response received from the web service running on port 50050.

[0163] Since it was previously obtained from the list of ports used by known C2 servers that port 50050 is used by the Cobalt Strike Team Server, in order to check the response received from the web service running on this port, a database well known in the subject area is selected from the database. area a characteristic feature inherent in Cobalt Strike Team Server: there is an extra space in the response of this server.

[0164] Verification of this circumstance can be performed in any well-known way. In the event that an extra gap is found in the server response, it is considered that an indicator of compromise has been found, and the method proceeds to the step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0165] In the event that an extra space is not found in the server response, it is considered that a legitimate web service is running on port 50050, and the method returns to the step at which the next checkpoint status is obtained.

[0166] In one possible implementation of the described method, if the checkpoint status is a value of a DNS resource record, then it is checked (not shown in Fig. 4A) by the analytical module (140) that the DNS is the server is functioning correctly. This can be done in any well-known manner, such as searching the text of the resource record for keywords or numbers corresponding to the correct functioning of the DNS server. In the event that such keywords are not found or the numerical values do not correspond to the correct functioning of the DNS server, it is considered that an indicator of compromise has been found, and the method proceeds to the step where, through the notification module (150) and the communication module (110), form and transmit a warning about a possible cyber attack. After that, the method returns to the step where the next checkpoint status is obtained.

[0167] As a non-limiting example, said checking of DNS resource record values may be against at least one of the following states, each of which is considered an indicator of compromise:

• None of the DNS is responding to requests that

• At least one of the DNS did not respond in time,

• At least one of the DNS has not declared itself authoritative,

• DNS SEC is not supported for this domain,

• The list of DNS provided by the root server (8.8.8.8) does not match the list published by the DNS

• There is only one DNS for this domain,

• Found at least one DNS that is capable of responding to any DNS lookup from any IP (Open Recursive Name Server),

• At least one DNS is an Open Zone Transfer Server and has provided information in the entire DNS zone,

• At least one DNS server has a private IP address,

• No published DNS record found for the given domain or hostname,

• More than one DNS is on the same class C subnet,

• The DNS SOA expiration date does not follow the recommended RFC,

• The DNS SOA cache value does not comply with the recommended RFC,

• The DNS SOA update value does not comply with the recommended RFC,

• The DNS SOA retry value does not follow the recommended RFC,

• SOA serial numbers do not match,

• Incorrect DNS SOA serial number format.

[0168] It will be obvious to a person skilled in the art how each of these checks can be performed. It is also obvious to the person skilled in the subject area that the words "given domain" or "given host" here denote that domain or computing device belonging to the protected infrastructure to which at least one DNS being checked corresponds.

[0169] In one possible implementation of the described method, if the checkpoint status is the value of a DNS (domain name system) resource record containing DMARC protocol settings, then it is checked (not shown in Fig. 4A) that that the DMARC protocol is installed and configured correctly. This can be done in any well-known manner, for example, by checking, performed by the analysis module (140), whether the text of the resource record contains DMARC tags corresponding to the correct protocol setting. The absence of such tags, as well as the absence of the resource record itself containing DMARC settings, is considered an indicator of compromise.

[0170] For example, a checkpoint status has been obtained, according to which the DNS resource record contains the following DMARC protocol settings:

[0171] "v=DMARC1; p=none;"

[0172] By means of the analytical module (140), it is verified that none of the tags present in the text of this resource record, the presence of which indicates the correct setting of the protocol, namely the quarantine and reject tags. Therefore, it is considered that an indicator of compromise has been detected, and the method proceeds to the step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0173] In another example, a checkpoint status has been obtained, whereby the DNS resource record contains the following DMARC protocol settings:

[0174] "v=DMARC1; p=quarantine; rua=mailto:admin@company.com"

[0175] By means of the analytical module (140), it is verified that in the text of this resource record there is one of the tags, the presence of which indicates the correct setting of the protocol, namely the quarantine tag. Therefore, it is considered that no indicator of compromise has been found, and the method proceeds to the step where the next checkpoint status is obtained.

[0176] Additionally, if the status of the checkpoint is a service running on some port, then it is checked (not shown in Fig. 4A) that the service is legitimate. It can be performed in any well-known way, for example, by searching, through the analysis module (140), the name of the service in a pre-compiled list of legitimate web services stored in the database of the information storage module (160).

[0177] For example, we received a checkpoint status, according to which the Apache Tomcat web service is running on port 8080. By means of the analytical module (140), a query is made to the database and it is found that the name Apache Tomcat is present in the list of legitimate services. Therefore, it is considered that no indicator of compromise has been found, and the method returns to the step at which the next checkpoint status is obtained.

[0178] In another example, a checkpoint status was obtained, according to which the TeamViewer web service is running on port 5938. By means of the analytical module (140), a query is made to the database and it is found that the TeamViewer name is not in the list of legitimate services. This is considered an indicator of compromise. Therefore, the method proceeds to a step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0179] Additionally, if the checkpoint status is a service running on some port, then it is checked (not shown in Fig. 4A) for the fact that the version of this web service does not belong to known vulnerable versions of this web service . Such verification against can be performed in any well-known way, for example, by searching, through the analytical module (140), the received version of the service in a pre-compiled list of vulnerable versions of legitimate web services stored in the database of the information storage module (160).

[0180] For example, we got the checkpoint status, according to which the Apache Tomcat v.3.3.2 service is running on port 8080. Using the analytical module (140), a database query is built and it is found that the version of Apache Tomcat v.3.3.2 is not in the list of vulnerable versions of this service. Therefore, it is considered that no indicator of compromise has been found, and the method returns to the step at which the next checkpoint status is obtained.

[0181] In another example, a checkpoint status was obtained, according to which the Cisco TFTP Server v.1.1 service is running on port 69. By means of the analytical module (140), a database query is built and it is found that the version of Cisco TFTP Server v.1.1 is present in the list of vulnerable versions of this service. This is considered an indicator of compromise. Therefore, the method proceeds to a step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to the step where the next checkpoint status is obtained.

[0182] Additionally, if the check described above showed that the web service running on some port is a legitimate service and is one of the database management systems (DBMS), such as MongoDB, or cloud storage, such as, for example, as S3 Buckets, then this service is checked (not shown in Fig. 4A) for the fact that this DBMS or this storage is inaccessible to unauthorized users. Such verification may be performed in any well-known manner.

[0183] In one of the possible implementations of this solution, the check may consist in selecting, by means of the analytical module (140), from the list of test queries stored in the database of the information storage module (160), a test query string, the syntax of which corresponds to the type of running web service and sending, via the communication module (110), this request to the address of the running web service. In response to receiving, via the communication module (110), an "Authorization Error" type response, it is considered that the DBMS or storage is not available to unauthorized users.

[0184] In response to receiving, by the communication module (110), any other response that is not an Authorization Error response, an indicator of compromise is considered to be detected. Therefore, in such a case, the method proceeds to a step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0185] For example, we received a checkpoint status, according to which a legitimate MongoDB service is running on port 27017. By means of the analytical module (140), a test query is selected from the database, corresponding to the MongoDB syntax, for example,

[0186] >db.users.find();

[0187] and send, via the communication module (110), this request to the address of the running web service. In response, via the communication module (110), a response of the form "Authorization error" is received. Therefore, it is considered that this DBMS is not available to unauthorized users, no indicator of compromise is found, and the method returns to the step at which the next checkpoint status is obtained.

[0188] In another example, a checkpoint status was obtained, according to which a legitimate mySQL service is running on port 3306. By means of the analytical module (140), a test query is selected from the database, corresponding to the syntax of mySQL, for example,

[0189] mysqli_connect('111.222.333.444:3306','root','root','DataBasel');

[0190] In response, via the communication module (110), a response of the form "Error: 2002 - No such file or directory" is received. This response is not an "Authorization Failed" response, so receiving it is considered an indicator of compromise. The method proceeds to a step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to the step where the next checkpoint status is obtained.

[0191] Finally, if the checkpoint status (256) is the validity period of the SSL or TLS certificate, then it is checked (258) for the fact that this validity period will expire soon, for example, it will expire within 30 days, starting from the current moment, or, for example, within 15 days. The check can be performed by the analytical module (140) in any well-known way, for example, by calculating the difference between the certificate expiration date obtained from the status (256) and the current date obtained from the system clock of the computing device implementing the method (200).

[0192] For example, at step (242), a checkpoint status (256) was obtained, according to which an SSL certificate was installed on the company.com domain, which expires on December 20, 2021. At step (258), the system clock is accessed by the analytical module (140) in any well-known way and the current date is obtained, for example, January 17, 2020. The current date is then subtracted from the certificate expiration date to obtain the value 703 (days). Comparing the resulting difference with a pre-set threshold equal to, for example, 30, it is verified that the company.com SSL certificate will be valid for longer than the specified time interval. Therefore, it is considered that no indicator of compromise has been found, and the method returns to step (242), where the next status is obtained.

[0193] In another example, at step (242), a checkpoint status (256) was obtained, according to which an SSL certificate was installed on the company.com domain, which expires on February 14, 2020. At step (258), the system clock is accessed by the analytical module (140) in any well-known way and the current date is obtained, for example, January 17, 2020. The current date is then subtracted from the certificate expiration date to obtain a value of 28 (days). Comparing the obtained difference with a pre-set threshold equal to, for example, 30, it is verified that the company.com domain SSL certificate will cease to be valid before the specified time interval expires. Therefore, it is considered that an indicator of compromise has been found, and the method proceeds to step (250), in which, through the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method also returns to step (242).

[0194] Additionally, if the status of the checkpoint is the encryption algorithms used by one of the objects of the protected infrastructure on which the SSL or TLS certificate is installed, then it is checked (not shown in Fig. 4A) for the fact that among used encryption algorithms, there are no weak encryption algorithms. Such a check can be performed by any well-known method, for example, by searching, by means of the analytical module (140), in the lists of codes corresponding to weak encryption algorithms, those codes that correspond to the encryption algorithms supported by this device. In this case, the list of codes corresponding to weak encryption algorithms is stored in the database of the information storage module (160).

[0195] For example, we received the status of a control point, according to which one of the protected infrastructure objects, for example, the site2.company.com domain, with a TLS v.1.2 certificate installed on it, uses encryption algorithms displayed by the following set of codes:

[0196] TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

[0197] Through the analytical module (140), a database query is built and it is found that the given set of codes corresponds to a secure or recommended set of encryption algorithms. Therefore, it is considered that no indicator of compromise has been found, and the method returns to the step at which the next checkpoint status is obtained.

[0198] In another example, a checkpoint status was obtained, according to which one of the objects of the protected infrastructure, for example, the company.com domain, with a TLS v.1.2 certificate installed on it, uses encryption algorithms displayed by the following set of codes:

[0199] TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

[0200] Through the analytical module (140), a database query is built and it is found that this set of codes corresponds to weak encryption algorithms. This is considered an indicator of compromise. Therefore, the method proceeds to a step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0201] In one possible implementation of the described method, if the checkpoint status is the security status of a web page to be checked for malicious code, then it is checked (not shown in Fig. 4A) for the fact that this is the status "The page is safe." This can be done in any well-known way, for example, by checking performed by the analysis module (140). If the current status of this checkpoint does not match the value "Page is secure", for example, if the current status is "Malware detected", it is considered an indicator of compromise.

[0202] Therefore, in such a case, the method proceeds to the step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0203] Also in one of the possible implementations of the described method, if the checkpoint status is the length of the list of links to web pages containing high-risk content, then it is checked (not shown in Fig. 4A) that the list length equals zero. This can be done in any well-known way, for example, by checking performed by the analysis module (140).

[0204] If the length of this list is zero, then it is considered that in the protected infrastructure there is not a single web page with high-risk content (that is, content devoted to topics such as gambling, erotica and pornography, narcotic substances, etc.) . In this case, the method returns to the step where the next checkpoint status is obtained.

[0205] If the length of the list of links to web pages containing high-risk content is different from zero, this is considered an indication of the presence of at least one page with such content within the protected infrastructure. This is considered an indicator of compromise.

[0206] Therefore, in such a case, the method proceeds to the step where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. After that, the method returns to the step where the next checkpoint status is obtained.

[0207] As described above with respect to step (210) and FIG. 2A, indicators of compromise processed by the described method may also include information about leaks of confidential data, for example, information about the names of companies whose illegitimate access to the infrastructure was put up for sale on specialized forums used by cybercriminals, information about confidential data put up for sale data of employees of such companies, as well as information that one of the computing devices belonging, judging by its IP address, to the protected infrastructure accessed at least one command and control server belonging to the attackers.

[0208] Where confidential data, in turn, is understood to mean at least: credentials of users of the protected infrastructure, personal data of users of the protected infrastructure, contact data of users of the protected infrastructure, including business email addresses, payment data of users of the protected infrastructure, and as well as other confidential information stored on devices belonging to the protected infrastructure, such as databases, file storages, network shared folders, etc.

[0209] Such indicators of compromise can be collected in closed sources, such as specialized cybercriminal forums, or obtained as a result of third-party systems that perform code analysis and / or detonation of malicious files in advance. Equally, such indicators of compromise can be collected in the specified sources constantly, by third-party systems or operators, converted to any suitable format, and periodically delivered, as described above, to the system implementing this method. For example, such indicators of compromise may come once a day, every four hours, every hour, and so on.

[0210] Data having the meaning of the next received portion of the above indicators of compromise can be considered by the system implementing the method (200) as the next status of the control point of the cyber attack surface of the protected infrastructure.

[0211] As shown in FIG. 4B, upon receipt (243) of the next such checkpoint status, in step (245) the analysis module (140) searches the incoming data for keywords corresponding to the confidential data of the protected infrastructure. The list of such keywords can be compiled in advance, at the stage of preparing the system that implements the method. Also, this entire list or its updates and additions can enter the system that implements the method through the communication module (110), for example, from one of the devices of the protected infrastructure (180), at a specified frequency, for example, once a day, and be stored in information storage module database (160).

[0212] The list can be compiled in any well-known way; for example, it may include the names of at least one company that owns the protected infrastructure, domain names of their domains, IP addresses of protected infrastructure devices, and other keywords that make it possible to detect the required confidential information or indications of that it is being used or offered for sale by attackers, or that at least one of the protected infrastructure devices has sent a request to at least one known attacker C&C server.

[0213] For example, in step (243), said checkpoint status was obtained, and in step (245), a keyword search was performed on the received data by the analytical module (140). The search yielded zero results; no keywords were found in the received data. This is interpreted as the absence on the resources used by attackers of any offers to sell compromised confidential data related to the protected infrastructure, as well as the absence in the results of analysis of code and / or traffic of known malicious programs executed by third-party systems, indications that some device belonging, judging by its domain name or IP address, to the protected infrastructure sent requests to some known external command and control server belonging to the attackers. Therefore, it is considered that the fact of compromise has not been detected, and the method returns to step (243), at which the next checkpoint status is obtained, that is, a new portion of data from Internet resources used by attackers.

[0214] In another example, in step (243) said checkpoint status was obtained, and in step (245), a keyword search was performed on the received data by the analytic module (140). The search returned a non-zero result; for example, when searching for the keyword representing the corporate email domain @company.com, valid corporate email addresses of current employees of the company were found: ivan@company.com, petr@company.com and emelya@company.com. The fact of detection of corporate addresses among the data offered for sale by attackers is considered an indicator of compromise. In another example, when searching for a keyword representing the IP address of one of the protected infrastructure devices, it was found that one of the known IP addresses belonging to the attackers' command and control servers was accessed from this address. Therefore, in both cases described, the method proceeds to step (250), where, by means of the notification module (150) and the communication module (110), a warning about a possible cyber attack is generated and transmitted. Thereafter, the method returns to step (245) where the keyword search is continued.

[0215] As described above with respect to FIG. 1 and the communication module (150), this module allows you to generate and send (via the communication module) alerts about a possible compromise of the protected network infrastructure in at least one of the following ways: by e-mail, by sending SMS, by sending MMS, by sending push- notification, a message in an instant messaging program, by creating an API event.

[0216] It should be noted that the use of such a notification tool as API events allows for additional integration of the described system with various third-party tools, such as firewalls, firewalls, security management platforms, SIEM solutions, and so on. The actual generation of all the listed alerts, such as emails, SMS, MMS, push notifications, etc. may be performed in any well-known manner.

[0217] In FIG. 5 shows an example of a general scheme of a computing device (500) that provides the data processing necessary to implement the claimed solution. As described above with respect to FIG. 1, the modules that implement the described method, from the point of view of their technical implementation, can be software modules executable on a single computing device, as well as software and hardware modules. For example, at least some of these modules, as well as a combination of these modules, may be implemented as the computing device (500) shown in FIG. 5.

[0218] In general, the device (500) includes components such as one or more processors (501), at least one random access memory or memory (502), data storage media (503), input/output interfaces (504), means of I/O (505), means of networking or, what is the same, data transmission (506).

[0219] The processor (501) of the device performs the basic computing operations necessary for the operation of the device (500) or the functionality of one or more of its components. The processor (501) executes the necessary machine-readable instructions contained in the main memory (502).

[0220] The memory (502) is typically in the form of RAM and contains the necessary software logic to provide the required functionality.

[0221] The data storage means (503) can be in the form of HDD, SSD disks, raid array, network storage, flash memory, optical storage media (CD, DVD, MD, Blue-Ray disks), etc.

[0222] Interfaces (504) are standard means for connecting and working with the server side, for example, USB, RS232, RJ45, LPT, COM, HDMI, PS / 2, Lightning, Fire Wire, etc. The choice of interfaces (504) depends on the specific implementation of the device (500), which may be a personal computer, mainframe, server cluster, thin client, smartphone, laptop, and the like.

[0223] The data I/O means (505) can be a keyboard, joystick, display (touchscreen), projector, touchpad, mouse, trackball, light pen, speakers, microphone, and the like.

[0224] Means of network interaction (506) are selected from devices that provide reception and transmission of data over the network, for example, an Ethernet card, WLAN / Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem etc. With the help of tools (506) the organization of data exchange over a wired or wireless data transmission channel, for example, WAN, PAN, LAN (LAN), Intranet, Internet, WLAN, WMAN or GSM, is provided.

[0225] The components of the device (500) are interfaced through a common data bus (510).

[0226] In conclusion, it should be noted that the information given in the description are only examples that do not limit the scope of the present invention described by the formula. A person skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

[0227] The exemplary systems and methods illustrated herein may be described in terms of functional block components. It should be appreciated that such functional blocks may be implemented by any number of hardware and/or software components configured to perform the specified functions. For example, the system may use various integrated circuit components such as memory elements, processing elements, logic elements, lookup tables, and the like, which may perform a variety of functions under the control of one or more microprocessors or other control devices. Likewise, the software elements of the system can be implemented using any programming or scripting language such as C, C++, C#, Java, JavaScript, VBScript, Macromedia Cold Fusion, COBOL, Microsoft Active Server Pages, assembly language, Perl, PHP , AWK, Python, Visual Basic, SQL stored procedures, PL/SQL, any UNIX shell script, and Extensible Markup Language (XML), with various algorithms being implemented with any combination of data structures, objects, processes, procedures, or other programming elements.

[0228] In addition, the cyberattack surface control system can operate on a single computing device, or on several interconnected via a network. Additionally, it should be noted that the system may use any number of conventional technologies for data transmission, signaling, data processing, network management, and the like. Still further, the system may be used to detect or prevent security issues with a client-side scripting language such as JavaScript, VBScript, and the like.

[0229] In this context, devices are understood to mean any computing devices built on the basis of software and hardware, for example, such as: personal computers, servers, smartphones, laptops, tablets, etc.

[0230] The data processing device can be a processor, microprocessor, computer (electronic computer), PLC (programmable logic controller) or an integrated circuit configured to execute certain commands (instructions, programs) for processing data. The processor can be multi-core, for parallel processing of data.

[0231] The memory device can be, but is not limited to, hard disk drives (HDD), flash memory, ROM (Read Only Memory), Solid State Drives (SSD), etc.

[0232] It should be noted that this device may include any other devices known in the prior art, such as sensors, data input/output devices, display devices (displays), and the like. The input/output device may be, but is not limited to, a mouse, keyboard, touchpad, stylus, joystick, trackpad, and the like, for example.

[0233] In the present application materials, a preferred disclosure of the implementation of the claimed technical solution was presented, which should not be used as limiting other, private embodiments of its implementation, which do not go beyond the scope of the requested legal protection and are obvious to specialists in the relevant field of technology.

Claims (105)

1. A method for external control of a cyberattack surface performed by a computing device, a method comprising steps in which: - receive information about the indicators of compromise and about the elements of the protected infrastructure and save them, - detect control points of the protected infrastructure, - scan the control points of the protected infrastructure and obtain information about the status of the control points of the protected infrastructure, - check for the presence of indicators of compromise in the information about the status of checkpoints, and in response to the detection of at least one indicator of compromise: - generate at least one warning about a possible cyber attack, - transmit at least one generated warning about a possible cyber attack. 2. The method according to claim 1, characterized in that the basic information about the elements of the protected infrastructure includes at least one of the following: domain, IP address SSL certificate, E-mail address, FTP server address address of the database management system, file hosting web service address, the name of the web service and the port on which it is running. 3. The method according to claim 1, characterized in that at least one of the following applies to the control points of the protected infrastructure: domains, IP addresses SSL certificates, TLS certificates, names and version numbers of web services, a link to at least one web page to be checked for malicious code, a list of links to web pages containing high-risk content. 4. The method according to claim 1, characterized in that a graph model of the Internet is used to detect control points of the protected infrastructure. 5. The method according to claim 1, characterized in that when checkpoints of the protected infrastructure are detected, the protected infrastructure is additionally scanned. 6. The method according to claim 1, characterized in that at least one of the following applies to the statuses of control points of the protected infrastructure: Domain Name System (DNS) resource record values. The value of the Domain Name System entry containing the DMARC protocol settings. The name of the company that owns the IP address. Hosting provider IP address. The expiration date of the IP address. List of ports open on the given IP address. List of network services running on the given IP address. The name of the company that owns the domain. Domain registrar. Domain expiration date. The status of the SSL or TLS certificate. Parameters of an SSL or TLS certificate, namely the encryption algorithms that can be used by the server on which this certificate is installed. The validity period of the SSL or TLS certificate. The security status of the web page to be checked for malicious code. The length of the list of links to web pages containing high-risk content. 7. The method according to claim 1, characterized in that the indicators of compromise also include at least one of the following: changing DNS data, incorrect functioning of the DNS, changing the owner of an IP address, changing the owner of a domain name, changing the status of an SSL certificate, changing the status of a TLS certificate, belonging of the used SSL encryption algorithms to the number of weak SSL encryption algorithms, belonging of the TLS encryption algorithms used to the number of weak TLS encryption algorithms, absence or incorrect setting of the DMARC protocol, opening of a new port, launching a new service the absence of a running service in the list of known legitimate services, whether the version of the launched legitimate service is among the known vulnerable versions, receiving, in response to a test request, from a legitimate web service, which is a database management system or cloud storage, any other response, except for the "Authorization error" response, domain name expiration, expiration of the SSL certificate, expiration of the TLS certificate, detection within the protected infrastructure of at least one web page with illegal content, detection of malicious code on at least one web page of the protected infrastructure, such as an exploit, web shell, JS sniffer, detection of at least one request from at least one of the devices belonging to the protected infrastructure to at least one intruder's C&C server, detection of at least one intruder C&C server within the protected infrastructure. 8. The method according to claim 7, characterized in that the incorrect functioning of the DNS means at least one of the following: None of the DNS is responding to queries. At least one of the DNS did not respond in time. At least one of the DNS has not declared itself authoritative. DNSSEC is not supported for this domain. The list of DNS provided by the root server does not match the list published by DNS. There is only one DNS for a given domain. Found at least one DNS that is capable of responding to any DNS lookup from any IP, i.e. open recursive DNS. At least one DNS provided information about the entire DNS zone. At least one DNS server has a private IP address. No published DNS entry found for the given domain or hostname. More than one DNS is on the same class C subnet. The validity period of the DNS SOA, that is, the initial record of the zone, does not follow the recommended RFC. The DNS SOA cache value does not follow the recommended RFC. The DNS SOA update value does not follow the recommended RFC. The DNS SOA retry value does not follow the recommended RFC. SOA serial numbers do not match. Invalid DNS SOA serial number format. 9. The method according to p. 1, characterized in that they additionally receive information about leaks of confidential data and save it. 10. The method according to claim 9, characterized in that it additionally checks for the presence of confidential data of the protected infrastructure in the information about leaks of confidential data, and in response to the detection of at least one case of leakage of confidential data of the protected infrastructure, at least one warning about possible cyber attack. 11. The method according to claim 9, characterized in that the confidential data of the protected infrastructure includes at least one of the following: credentials of protected infrastructure users, personal data of protected infrastructure users, contact details of protected infrastructure users, payment data of protected infrastructure users, confidential information stored on protected infrastructure devices. 12. The method according to claim 1, characterized in that at least one generated cyber attack warning is transmitted via at least one of the following communication methods: e-mail (e-mail), SMS, mms, push notifications, messages in the instant messaging program, API events. 13. The system of external control of the cyber attack surface, configured to exchange traffic with devices of the protected infrastructure and containing at least: a communication module configured to obtain information about indicators of compromise and elements of the protected infrastructure, as well as to transmit at least one generated warning about a possible cyber attack; an infrastructure discovery module configured to detect checkpoints of the protected infrastructure; a scanning module configured to scan the checkpoints of the protected infrastructure and obtain information about the statuses of the checkpoints of the protected infrastructure; an analysis module configured to check the presence of indicators of compromise in information about the statuses of control points of the protected infrastructure; an alert module configured to generate, in response to the detection of at least one indicator of compromise, at least one warning of a possible cyber attack; information storage module containing at least one database, as well as machine-readable instructions, which, when executed, ensure the execution of the method according to paragraphs. 1-12.

Images