METHOD OF CREATING SCRIPT OF POPULAR ACTIVATION EVENTS Russian patent published in 2019 - IPC G06F21/00 G06F21/50 G06F21/53 G06F21/56 

FIELD: computer equipment.

SUBSTANCE: invention relates to methods for monitoring the execution of the investigated software in order to detect the behavior characteristic of malicious software. To do this, get a lot of scripts, get a list of activation events of malicious behavior from at least one script from the received set of scripts; collect all the events caused by the execution of the activation event of the malicious behavior from the list of events of the activation of the malicious behavior during the execution of the application being studied in the modified software and hardware of the computer device; and detect the activation of the malicious behavior of the application under study based on the analysis of all collected events by identifying events characteristic of the malicious behavior.

EFFECT: achieving the creation of a script of popular events by selecting from the event scenarios the activations of the event that activated the malicious behavior when executing the monitoring of the application being monitored, and recording it in the script of popular events.

1 cl, 7 dwg