SYSTEM AND METHOD OF REDUCING LOAD ON OPERATING SYSTEM WHEN EXECUTING ANTIVIRUS APPLICATION Russian patent published in 2015 - IPC G06F21/00 

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to antivirus systems. A method of determining required analysis of events during antivirus inspection based on the current trusted status of the process includes the following steps: a) monitoring execution of the process in the operating system by process monitoring means; b) assigning an initial process status by the process monitoring means, wherein the process status is a trusted process or non-trusted process; c) using the process monitoring means, in accordance with the current process status, to establish at least one event type, the events of which are detected in a stream of all events for said process, wherein the established event types are at least mandatory or critical events, wherein if said process has a trusted process status, then a mandatory event type is established therefor, and if said process has a non-trusted process status, at least two event types are established therefor, specifically a critical event type and a mandatory event type, where: the mandatory event is an event upon detection of which evaluation of the process status should be performed for possible change of the current process status; the critical event is an event upon detection of which evaluation of process status should be performed based on antivirus inspection of the launched process or file, from which said process was launched; d) performing analysis of each detected event according to the current process status using evaluation criteria which define the need to change the process status using event processing means, wherein information on evaluation criteria is stored in an evaluation criteria database; e) making a decision on the need to change the current process status based on the performed analysis using the event processing means; f) using the process monitoring means to change the current process status based on the decision and switching to step c).

EFFECT: reducing the number of events associated with execution of the process requiring analysis during antivirus inspection.

15 cl, 5 dwg