COMPLEX CLASSIFICATION FOR DETECTING MALWARE Russian patent published in 2018 - IPC G06F21/56 

FIELD: protection of computer systems from malware.

SUBSTANCE: invention relates to protection of computer systems from malware. Host system for detecting malware entity is discovered comprising a memory unit that stores instructions, using which the host system, when performed by at least one hardware processor of the host system, executes the entity management module, the entity assessment engine and the classification engine, wherein: the entity management module is configured to manage a collection of assessed software entities, the collection management comprising: identifying a set of daughter entities of the first collection entity; determining if the first entity is complete; in response, when the first entity is completed, determining if all members of the set of daughter entities are completed; and in response, when all members of the set of daughter entities are completed, removing the first entity from the collection; entity assessment engine is configured with the ability to: assess the first entity according to the assessment criterion; and in response, when the first entity satisfies the assessment criterion, transmit the assessment indicator to the classification engine; classification engine is configured to: record the first indicator determined for the first entity and the second indicator determined for the second entity of the collection, wherein the first and second indicators are determined according to the assessment criterion; in response to the recording of the first and second indicators and in response to the receipt of the assessment indicator, update the second indicator according to the assessment indicator; in response, to determine whether the second entity is malicious according to the updated second indicator, in response to the recording of the first and second indicators and in response to the receipt of the assessment indicator, update the second indicator according to the assessment indicator; in response, to determine whether the second entity is malicious according to the updated second indicator.

EFFECT: technical result is the determination whether the software entity is malicious, based on a variety of indicators for the assessment of the relevant entity, which makes it possible to create a more robust anti-malware solution in comparison with similar traditional solutions.

15 cl, 13 dwg