SYSTEM AND METHOD FOR LOG FORMING IN VIRTUAL MACHINE FOR ANTI-VIRUS FILE CHECKING Russian patent published in 2018 - IPC G06F21/53 G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to solutions for detecting malicious files. Method for deciding to recognize malicious file opened in virtual machine as environment for safe execution of files is disclosed, at that method comprises steps, when: a) during process flow created when file is opened, occurrence of event that is associated with change in at least one page of virtual memory is detected; b) during execution of process flow created when opening file, control transfer to at least one modified virtual memory page is detected; c) log to which following events are saved is created: events that occur during process stream, created when file is opened in modified memory page, and context of processor on which process flow, created when file is opened, is read when logged event occurs; d) saved events in created log are compared with processor context with at least one template; e) it is decided whether to recognize file as malicious, based on comparison results.

EFFECT: technical result is to increase security of computer system, which is achieved by deciding whether to recognize malicious file opened in virtual machine.

8 cl, 4 dwg