DETECTION OF HARMFUL SOFTWARE WITH CROSS-REVIEW Russian patent published in 2018 - IPC G06F21/56 G06F21/50 

FIELD: computer safety.

SUBSTANCE: invention relates to computer security. Computing device for determining a suspicious executable object is disclosed, comprising a storage device and one or more hardware and/or software logic elements, comprising a cross-view detection mechanism configured to monitor the first operation, executed by the executable in the memory at the first level of abstraction; monitoring, in fact, simultaneous second operation performed by the executable object in the memory at the second level of abstraction, second level of abstraction differs from the first level of abstraction; determination that the first operation, in essence, causes a different computational result than the second operation, definition comprises converting the first operation and the second operation into a comparable format; and designating the executable object as suspicious.

EFFECT: technical result is a more reliable definition of a suspicious executable object that can be malicious software.

23 cl, 5 dwg