METHOD AND SYSTEM FOR ANALYSING OPERATION OF SOFTWARE DETECTION RULES Russian patent published in 2015 - IPC G06F21/56 G06F11/36 

FIELD: information technology.

SUBSTANCE: method of declaring file detection rules reliable, which includes selecting, from a set of existing files, a subset of known files; dividing the selected subset of known files into subsets of safe and harmful files; creating a file detection rule based on at least one known file from the subset of harmful files; checking unknown files from the set of existing files; declaring the detection rule reliable if the degree of similarity of neither one of the selected unknown files with known files from the subset of safe files does not exceed a set similarity threshold and the degree of similarity of selected unknown files with at least one file from the subset of harmful files exceeds the set similarity threshold.

EFFECT: fewer cases of false triggering of file detection rules.

2 cl, 5 dwg