METHOD OF ANALYSING MALICIOUS ACTIVITY ON INTERNET, DETECTING MALICIOUS NETWORK NODES AND NEIGHBOURING INTERMEDIATE NODES Russian patent published in 2014 - IPC G06F21/51 

FIELD: physics, computer engineering.

SUBSTANCE: present invention relates to antiviruses and specifically to methods of detecting malicious infrastructure. A method of detecting intermediate nodes in a computer network through which malware is distributed, wherein the intermediate nodes are connected to the Internet, to which malicious nodes are also connected. The present method employs a system of computer tools, services for detecting a traffic route in a network, a WHOIS service for accessing login information about an owner of a domain or IP address, followed by constructing flow chart of distribution of malware from a malicious site over data link channels, evaluating the usage rate of the link channel for distributing malware, detecting and blocking an intermediate node used illegally; the method further allows the unblocking of the intermediate node if the intensity of distribution of malware considerably drops over time or ceases to pose a threat to the site which directly contained the malware.

EFFECT: detecting malicious infrastructure by analysing links between network nodes, constructing a flow chart of communication between network nodes and automatic analysis of the strength of the link between nodes.

17 cl, 9 dwg, 3 tbl