SYSTEM AND METHOD FOR DETECTING MALICIOUS EXECUTABLE FILES BASED ON SIMILARITY OF EXECUTABLE FILE RESOURCES Russian patent published in 2015 - IPC G06F21/56 

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to computer engineering. A system for detecting malicious executable files based on similarity of executable file resources comprises resource processing means for determining the type of an executable file and at least one type in accordance with the determined type of the executable file, detecting at least one resource of the determined type of executable file using the resource processing means, converting the at least one detected resource of the determined type into a format for comparison and transmission thereof to a comparing means; a comparing means for calculating the degree of similarity of at least one detected resource of the determined type with resources of said type from resources of known malicious executable files from a resource database using comparison algorithms for corresponding types of resources, transmitting the result of calculating the degree of similarity to a verification means; a verification means for determining if an executable file is malicious using determination rules based on the calculated degree of similarity of at least one detected resource of the determined type with resources of said type from resources of known malicious executable files.

EFFECT: high efficiency of detecting malicious executable files.

3 cl, 7 dwg, 3 tbl