METHOD AND SYSTEM OF PROTOCOLS ANALYSIS OF HARMFUL PROGRAMS INTERACTION WITH CONTROL CENTERS AND DETECTION OF COMPUTER ATTACKS Russian patent published in 2017 - IPC G06F21/55 G06F21/53 H04L29/02 

FIELD: information technology.

SUBSTANCE: malicious program in a virtual environment is run; requests sent by malicious program to the malicious software control center are collected; the parameters in collected requests and their order are determined; requests with the same sets of parameters are grouped; for each group of requests a regular expression describing the parameters of this group of requests is formed; a request, described by the regular expression received in the previous step, is formed and sent to the malicious program cintrol center; a response from the control center is received, while if the response is encoded and/or encrypted, then it is decoded and/or decrypted; the response is analyzed to the presence of information, specific to conducting network attacks; the results are stored; computer attacks are identified using the results of analysis.

EFFECT: increasing the effectiveness of detecting computer attacks.

17 cl, 3 dwg