FIELD: information technologies.
SUBSTANCE: invention relates to the field of information security, namely to the malicious files in the network traffic detection. Malicious files in the network traffic detection server contains communication module, which is designed with possibility to receive the network traffic from the data network, filtering module, which is designed with possibility of the communication module connection to receive the captured network traffic therefrom and plurality of files extraction from the received network traffic, the extracted files analysis with enabling of at least one suspicious file detection from the said plurality of files, connected to the filtering module the system monitoring module, which is designed with possibility of each received suspicious file running on the virtual machine, characterized by the state parameters specified set, registration of changes in the said virtual machine state parameters specified set, connected to the system monitoring module processing module, which is designed with possibility of the state parameters obtained changes analysis using the analysis rules specified set, with enabling of the said launched file classification as the malicious files, if the state parameters analyzed changes are characteristic for the malicious files.
EFFECT: increase in the computing resources using efficiency while providing the automated protection.
38 cl, 2 dwg
