SYSTEM AND METHOD OF AUTOGENERATION OF DECISION RULES FOR INTRUSION DETECTION SYSTEMS WITH FEEDBACK Russian patent published in 2017 - IPC G06F21/55 

FIELD: information technology.

SUBSTANCE: method includes the following steps: receiving at least one event from the event database generated by data received from at least one sensor; analyzing at least one received event for the class of interaction with the malware control centres; extracting from at least one of the above-mentioned events of the class of interaction with the malware control centres at least one feature used to form the decision rules; form decision rules using at least one of the above-mentioned extracted feature; storing the formed decision rules and providing an opportunity to receive an update of the decision rules for at least one sensor; sensors cyclically check the availability of updates in the central node and, if updates are available, receive them for use, and if updates are received, a trigger is activated in the sensors that restarts the decision rules.

EFFECT: increase in the effectiveness of detecting computer attacks.

8 cl, 3 dwg