FIELD: information technologies.
SUBSTANCE: invention relates to occurring in the operating system abnormal events detecting methods. Starting the agent recording events that occur in the operating system. Using at least one installed in the operating system interceptor detecting an event that has occurred in the operating system. Recording the detected by the interceptor event and using the agent receiving the specified event context from the computer device. From the obtained context selecting the event signs by means of the digest formation and based on the selected signs forming the event digest. Formed event digest popularity is determined by means of comparison. By the comparison means recognizing the detected as abnormal one, if the specified event digest popularity is below the threshold value.
EFFECT: technical result is provision of the abnormal events detection occurring in the client's operating system during the software execution.
22 cl, 5 dwg
| Title | Year | Author | Number |
|---|---|---|---|
| METHOD FOR DETECTING ANOMALOUS EVENTS ON BASIS OF CONVOLUTION ARRAY OF SAFETY EVENTS | 2017 |
|
RU2673711C1 |
| SYSTEM AND METHOD OF GENERATING LOG WHEN EXECUTING FILE WITH VULNERABILITIES IN VIRTUAL MACHINE | 2018 |
|
RU2724790C1 |
| METHOD FOR PROCESSING INFORMATION SECURITY EVENTS PRIOR TO TRANSMISSION FOR ANALYSIS | 2020 |
|
RU2762528C1 |
| SYSTEM AND METHOD OF DETECTING MALICIOUS CODE IN FILE | 2016 |
|
RU2637997C1 |
| WEB PROPERTY MODIFICATION DETECTION SYSTEM AND METHOD | 2018 |
|
RU2702081C2 |
| SYSTEM AND METHOD OF DETECTING FRAUDULENT ONLINE TRANSACTIONS | 2014 |
|
RU2571721C2 |
| SYSTEM AND METHOD OF DETECTING THREAT IN CODE EXECUTED BY VIRTUAL MACHINE | 2012 |
|
RU2522019C1 |
| SYSTEM AND METHOD OF DETECTING THE SIGNS OF COMPUTER ATTACKS | 2017 |
|
RU2661533C1 |
| SYSTEM AND METHOD OF MAKING FLEXIBLE CONVOLUTION FOR MALWARE DETECTION | 2013 |
|
RU2580036C2 |
| SYSTEM AND METHOD OF CREATING ANTIVIRUS RECORD | 2018 |
|
RU2697954C2 |
