FUZZY WHITELISTING ANTI-MALWARE SYSTEMS AND METHODS Russian patent published in 2017 - IPC G06F21/56 

FIELD: computer safety.

SUBSTANCE: invention relates to computer security. Disclosed is a method comprising, in response to a tentative determination that a target object is suspected of being malicious, generating at a client computer system a plurality of target hashes of target object, each target hash representing a distinct code block of target object, comprising a sequence of processor instructions; sending a plurality of target hashes to a server; receiving from server computer system a server-side indicator of whether target object is malicious, wherein server-side indicator is generated by retrieving a plurality of reference hashes of a reference object for at least a target hash of plurality of target hashes, wherein reference object is selected from a set of whitelisted objects according to target hash, when plurality of target hashes is not identical to plurality of reference hashes, determining a similarity score according to a count of hashes common to both plurality of target hashes and plurality of reference hashes; and when similarity score exceeds a predetermined threshold, designating target object as non-malicious.

EFFECT: technical result consists in improvement of efficiency of whitelisting, without reduction of data security.

30 cl, 11 dwg