METHOD FOR PROTECTION OF COMPUTER NETWORKS Russian patent published in 2013 - IPC G06F21/00 H04L9/32 

FIELD: radio engineering, communication.

SUBSTANCE: multiple reference sets of appearances of unauthorised information flows are set, which differ from each other by identifiers S_REF ⁼{S_j}, and also the threshold value of hit ratio Q_{HIT THRESHOLD} is set for a sequence of appearances of an unauthorised information flow with an appropriate reference set, after identification of identifiers from a heading of another received packet of messages and their comparison with reference identifiers, in case of mismatch of a receiver's address in the received packet of messages of an unauthorised information flow with specified false addresses of subscribers of a computer network it is additionally added into a list of preset false addresses of subscribers of a computer network, then the message packet is sent to specified false addresses of computer network subscribers, identifiers of appearance of K_i of the received unauthorised flow are compared with values available in reference sets S_j of appearances of unauthorised information flows, in case of mismatch a new S_j+1 reference set is generated and memorised, afterwards they compare values of the produced hit ratio Q_HIT with the threshold value Q_{HIT THRESHOLD}, and if the condition Q_HIT≥Q_{HIT THRESHOLD} is met, they block the unauthorised information flow, and an attack signal is generated to the computer network.

EFFECT: higher security, also validity and efficiency of detecting unauthorised impact at a computer network.

4 dwg