SYSTEM AND METHOD OF DETECTING MALICIOUS FILES OF CERTAIN TYPE Russian patent published in 2016 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to antivirus technologies, and more specifically to systems of detecting malicious files of a certain type. Result is achieved by using a method of creating a signature to detect malicious files of a certain format, which comprises steps of: detecting a suspicious file and recognising its format, based on which said file is checked using an antivirus and a collection of safe files. Suspicious file is checked using a virtual machine in case suspicious file is not safe based on comparison with safe collection of files or malicious after anti-virus scan. After analysis of results of checking suspicious file using a virtual machine is created a tree structure of signatures for detected malicious files, which is used for storage of signatures. Creating a signature for detected file, if analysis results show that suspicious file is malicious and stored signature in said tree structure of signatures.

EFFECT: technical result consists in providing possibility of detecting malicious code in files of a certain type by means of corresponding signatures.

2 cl, 5 dwg