METHOD OF COMPUTER SECURITY DISTRIBUTED EVENTS INVESTIGATION Russian patent published in 2017 - IPC G06F21/55 

FIELD: information technologies.

SUBSTANCE: invention relates to field of information protecting in computer systems. Disclosed is method, in which loading data on system events from all users computers to security server; among these events recording, at least, one system event, caused safety incident; analyzing loaded events by searching among them of such, which similar to events, preceding to already registered safety incident; performing correlation analysis of event data distributed over time and place, using additional rules, including following actions: setting background conditions and analysis depth level; generating initial plurality of rules to perform correlation analysis; performing significant rules selection into active plurality; detecting and eliminating conflicts among selected rules; checking for each of active plurality rule for conformity of actual analysis depth to specified; performing search and application of solution for elimination of consequences and safety incident prevention; generating security incident report.

EFFECT: technical result consists in reduction of number of undetected computer security incidents.

7 cl, 4 dwg, 2 tbl