RU2783224C1 - Method for identifying software vulnerabilities forming the conditions for information security violation in an information system due to a computer attack - Google Patents

Abstract

FIELD: information protection.

SUBSTANCE: method for identifying software vulnerabilities forming the conditions for information security violation in an information system due to a computer attack consists in forming a set of types of terms of known computer attack techniques (hereinafter referred to as techniques) and vulnerabilities identified by analysing the descriptions of techniques and vulnerabilities; determining the weights of each type of terms by an expert evaluation method; forming an ordered vector of types of terms with account to the weights; forming vector representations of each technique and vulnerability included in the formed set, represented as values of the types of terms; calculating measures of matching of the descriptions of techniques and vulnerabilities in order to determine identity thereof; and forming a list of vulnerabilities required to implement a computer attack based on the calculated measures of matching of the descriptions of techniques and vulnerabilities.

EFFECT: higher effectiveness of forming a list of information system vulnerabilities, the operation whereof may lead to a violation of information security in the information systems.

1 cl, 1 dwg

Description

FIELD OF TECHNOLOGY TO WHICH THE INVENTION RELATES

The invention relates to the field of protection of information processed in an information system, and can be used to determine the list of software vulnerabilities (hereinafter referred to as vulnerabilities) of an information system (hereinafter referred to as IS) necessary to implement a computer attack on IS, which can lead to a security breach information in this system.

BACKGROUND OF THE INVENTION

In the modern world, according to regulatory legal acts and the results of the analysis of computer incidents, threats to information security are no longer a single action of an intruder to exploit a vulnerability to achieve their destructive goals, but a multi-stage advancement of an intruder through IP by applying various technical methods (techniques).

Information security threats are implemented by computer attacks, which are an ordered sequence of actions of an intruder to achieve destructive goals related to information security violation in an information or automated control system. Each computer attack is implemented according to a specific scenario, which is a description of the order in which the attacker's actions are performed. At the same time, part of the actions of the offender is implemented by techniques related to the exploitation of vulnerabilities. Currently, information about known vulnerabilities and techniques can be obtained from various databases of vulnerabilities, threats and exploits, knowledge bases about tactics and techniques, websites of software manufacturers and other sources. However, these sources do not provide any information about the links between vulnerability records and techniques. In addition, there are no automated software tools in the public domain that make it possible to determine information about the possible techniques of an intruder related to the exploitation of certain vulnerabilities and the computer attacks implemented in this case. Thus, the identification of techniques based on information about known vulnerabilities for a particular IS and the formation of computer attack scenarios is done manually by sequentially analyzing information about each identified vulnerability, which is a very time-consuming task. Closest to the claimed method is a method based on the use of the apparatus of neural network technologies to determine the current threats to the security of IS information [1]. This method is designed to automate the procedure for obtaining information about threats relevant to IP based on data on IP vulnerabilities. The information about vulnerabilities contained in the database of information security threats of the FSTEC of Russia (hereinafter referred to as the data bank) is used as the initial data for training neural networks.

The disadvantages of this method is the need to create training samples based on expert methods, and the specialists who make up the initial data must have deep knowledge in the field of information security, building information systems and information protection systems. In addition, the developed method [1] assumes the creation of artificial neural networks for each threat, which is, firstly, a time-consuming task, the solution of which requires special knowledge in the field of neural network technologies, and secondly, this task is solved by developing special software tools .

DISCLOSURE OF THE INVENTION

The objective of the invention is to develop a method that allows to automate the procedure for determining the list of IS vulnerabilities necessary to implement a computer attack on IS, which can lead to a breach of information security in this system.

The technical result to be achieved by the invention is to reduce the complexity and laboriousness of the process of forming a list of IS vulnerabilities, the operation of which can lead to a breach of information security in the IS.

The specified result is achieved by implementing a method for determining the list of vulnerabilities based on the use of a vector model of their descriptions and includes the steps at which:

form a set of types of terms of techniques and vulnerabilities determined by analyzing their descriptions;

determine the weights of each type of terms by an expert method;

form an ordered vector of types of terms, taking into account their weight;

form a vector representation of technology and vulnerability, represented as values of types of terms;

calculate the measure of convergence of descriptions of technology and vulnerability in order to determine their identity. The measure of convergence is necessary for comparing the texts of descriptions of vulnerabilities and techniques, determining their identity, and depends on the result of a logical comparison of the values of the types of vulnerability terms and the values of the weights of the corresponding types of terms;

form a list of vulnerabilities necessary to implement a computer attack.

IMPLEMENTATION OF THE INVENTION

In FIG. 1 shows a flowchart of the sequence of operations illustrating a method for determining vulnerabilities that form the conditions for violating the security of information in an IS due to a computer attack, based on a vector model.

At stage 1, a set of types of terms of techniques and vulnerabilities is formed, determined by analyzing their descriptions, by which their correspondence can be established. The set of types of terms for vulnerabilities and techniques includes: access vector; destructive action; consequence; type of software; reason for existence; object of influence; authentication; tool; the condition for the existence of a vulnerability; information technology; actions of the UBI source; implementation method; actions of users (victims).

Each of these types of terms is not mandatory in the description of each vulnerability or technique, but each has its own specific significance. The order in which the types of terms above are presented is based on the importance of the word for identifying a given text in the description in descending order. The importance is determined by experts. It has been determined that it is more important to establish the identity of the consequences that the exploitation of a vulnerability and the implementation of a technique (action) and a threat to BI can lead to than passing the authentication procedure.

Thus, all types of terms that occur in descriptions are ordered. Formally, vectors, which are representations of vulnerability and technique descriptions in a vector space, consisting of all types of terms written in descending order of weight, including those that do not occur, can be represented as follows:

where d is a vector representation of the description of vulnerabilities and techniques,

Tt _n is a variable denoting the type of term,

n is the total number of term types.

At stage 2, the weights of each type of terms are determined by an expert method. The most significant are those types of terms, the values of which occur most often in descriptions of vulnerabilities and techniques. The frequency of occurrence is determined during the analysis of these descriptions at stage 1. The types of terms "access vector", "destructive action" and "consequence" have the highest weight, the value of which is taken equal to 1, and the types of terms such as "source actions" have the lowest weight. UBI", "method of implementation", "actions of users (victims)" - 0.1.

At step 3, an ordered vector of term types is formed, taking into account their weight.

For each type of term, a weight coefficient is defined that determines its significance in the process of comparing vulnerability and technology, which is determined by the vector:

where d _w is a vector representation of the weights of the vulnerability and technique descriptions,

w _n - weight coefficient of term type Th _n , takes values from 0 to 1;

n is the total number of term types.

At step 4, a vector representation of the technique and vulnerability is formed, presented as values of the types of terms. The vector representation of technology can be represented in the following form:

The vector representation of the vulnerability can be represented as follows:

At step 5, a measure of convergence of descriptions of technology and vulnerability is calculated in order to determine their identity. Having a vector representation for techniques and vulnerabilities, their identity is determined by calculating the measure of convergence using the following formula:

с каждой известной уязвимостью.For the analyzed technique, the measure of convergence is considered

with every known vulnerability.

окажется максимальной, определяется однозначное установление тождественности. Таким образом, определяется перечень уязвимостей, необходимых для реализации компьютерной атаки, состоящей из известной последовательности техник, выполняемых нарушителем.At stage 6, a list of vulnerabilities necessary to implement a computer attack is formed. For the vulnerability for which the measure of convergence

turns out to be maximum, a unique identity establishment is defined. Thus, the list of vulnerabilities necessary for the implementation of a computer attack, consisting of a known sequence of techniques performed by the offender, is determined.

The inventive method has been tested experimentally in the laboratory.

The proposed technical solution is new, since from publicly available information there is no known method for determining potential IS vulnerabilities using:

analysis of descriptions presented in verbal form, with the subsequent formation of distinctive features - types of terms;

formation of a vector representation of descriptions of techniques and vulnerabilities;

calculation of a measure of convergence to determine a one-to-one correspondence.

The proposed technical solution is industrially applicable, since standard computer equipment and software produced by the industry and available on the market can be used for its implementation.

The advantages of the present invention are as follows:

the implementation of the method allows you to manually or automatically solve the laborious task of obtaining information about potential IS vulnerabilities that are necessary to implement a computer attack on IS;

the proposed method allows you to unambiguously determine the identity of the vulnerabilities and techniques of the intruder that make up a computer attack, which allows you to build effective IP protection by eliminating vulnerabilities, the exploitation of which can lead to a breach of information security;

the implementation of the method can be carried out without financial costs, since free software can be used for its implementation.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by drawings and graphics, which show:

in fig. 1 is a flowchart illustrating a method for determining vulnerabilities.

Bibliography:

1. Mamuta V.V., Soloviev S.V. A method for determining potential threats to information security based on information about software vulnerabilities // Patent of Russia No. 2705460, 2019 (application No. 2019107861 of 03/19/2019).

Claims (7)

A method for determining software vulnerabilities that create conditions for violating information security in an information system due to a computer attack, characterized in that in order to determine the list of vulnerabilities that create conditions for violating information security in an information system due to a computer attack, the following sequence of actions is performed: form a set of types of terms of known techniques of computer attacks (hereinafter referred to as techniques) and vulnerabilities determined by analyzing descriptions of techniques and vulnerabilities; determine the weights of each type of terms by an expert method; form an ordered vector of types of terms, taking into account their weight; form vector representations of each technique and vulnerability included in the generated set, represented as values of term types; calculate measures of convergence of descriptions of techniques and vulnerabilities in order to determine their identity; form a list of vulnerabilities necessary for the implementation of a computer attack, based on the calculated convergence measures of descriptions of techniques and vulnerabilities.

Images