METHOD FOR DETECTION OF MALICIOUS SOFTWARE CODES IN NETWORK DATA TRAFFIC, INCLUDING EXPOSED TO COMBINATION OF POLYMORPHIC TRANSFORMATIONS Russian patent published in 2017 - IPC G06F21/56 H04L29/02 

FIELD: information technology.

SUBSTANCE: method in which ordered memory containing recorded traffic is separated to series of equal volume blocks of predetermined length; traffic image is formed in-memory, allocating an ordered set of cells with number of cells equal to number of blocks; in each of traffic blocks states of all memory cells included in the analyzed block is compared, the number of unique states of cells is defined in each block; values corresponding to the number of unique states of cells in i-th blocks of analyzed traffic is recorded in i-th image cells; degree of similarity of all subsets of consecutive cells of image generated with all standards is determined selecting such subsets of length equal to the length of at least one of the standards, and calculating the value of the degree of similarity of fragments of image generated with malicious software standards.

EFFECT: increased completeness of detection of malicious software, including exposed to polymorphic transformations.

2 dwg