SYSTEM AND METHOD FOR IDENTIFYING MALICIOUS FILES Russian patent published in 2018 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to computer security. This method for determining a malicious file in which at least the calls of API functions are recorded in the local call log of each computing device during the execution of the same files, during the execution of the file, the local log of calls for matching registered at least API function calls to behavioral rules from the local threat database is searched, in the case when no match to the behavioral rules is found, the local call log is transmitted to the detector, using the detection tool, the local call logs of the same files are combined into the combined call log, so that for each local call log, in the combined call log, there is at least one entry that is not in the local call log, entries from the combined call log matching at least one behavioral rule from the threat database are searched, when entries from the combined call log matching at least one behavioral rule from the threat database are found, the file is identified as malicious according to the found behavioral rule.

EFFECT: improving the identification of a malicious file using behavioral rules.

15 cl, 5 dwg