SYSTEM AND DETECTING METHOD OF REMOTE ADMINISTRATION APPLICATION Russian patent published in 2017 - IPC G06F21/56 G06F21/71 

FIELD: information technology.

SUBSTANCE: system contains an activity analysis tool, a dependency detection tool, a search tool, an analysis tool. The activity analysis tool is designed to intercept events that occurred in the computer system, while the computer system event represents a set of actions performed by the application in the computer system. The analysis tool is also designed to determine the parameters of each intercepted event, at the same time the parameters of computer system event represent a set of different properties of the computer system event, time elapsed between registering the selected event and subsequent recording of the intercepted event, and passing certain parameters of the intercepted events to the dependency detection tool.

EFFECT: ensuring the counteraction to unauthorized administration of the computer system through detection of remote administration applications.

2 cl, 3 dwg