METHOD OF DETECTING MALICIOUS CODE IN RANDOM-ACCESS MEMORY Russian patent published in 2016 - IPC G06F12/14 G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to protection from computer threats, particularly methods of detecting malicious code in random-access memory. Method of using application control module includes steps of: detecting at least one untrusted process, wherein process is untrusted if it is started from an untrusted application; collecting data on application, from which is started at least one untrusted process; intercepting a call of at least one function of interprocess interaction implemented by untrusted process; determining call features of at least one intercepted function interprocess interaction; determining need to analyse code in addressing space of process, which is purpose of calling function interprocess interaction, by means of at least one heuristic rule, application of which to collected data on application, as well as to determination at previous step of features of call determines need for analysis of code at same time for purpose of call function interprocess interaction refers to process, on which function call interprocess interaction; code analysis is performed in memory area of process, which is to call function interprocess interaction, in order to detect malicious code, result of analysis is recognition or non-recognition of said code in he memory area objects; determining functional detected malicious code in memory area of process, which is to call function interprocess interaction, under functional code is a set of system calls, which can be performed during code execution; formed at least one rule application control module control applications in addressing space of which is a code, which was found objects, based on determined at stage of previously functional said malicious code; control module is used applications according to at least one formed at stage of previously rule control application.

EFFECT: improved protection of computing device.

5 cl, 4 dwg