DETECTING A THREAT OF A ZERO DAY WITH THE USE OF COMPARISON OF A LEADING APPLICATION/PROGRAM WITH A USER AGENT Russian patent published in 2018 - IPC G06F21/56 H04L12/22 

FIELD: network security.

SUBSTANCE: invention relates to network security. Non-transitory computer-readable medium contains instructions that, when executed, cause the interception machine to execute by the first data requiring device from the second device, request is generated by the application and the request is identified by a user agent; and generating an indication in response to determining that a predetermined threshold number of different user agents has been identified in the requests from the application, indicating that the application is a potentially malicious program, with the specified threshold amount depending on the application. Technology allows to link leading applications and user agents in network traffic and detect possible malicious programs without relying on the signatures of user agents.

EFFECT: technical result is to provide detection of a malicious program that introduces randomness into user agent data.

21 cl, 7 dwg