METHOD OF DETECTING MALICIOUS FILES THAT COUNTERACT ANALYSIS IN ISOLATED ENVIRONMENT Russian patent published in 2019 - IPC G06F21/00 G06F21/56 

FIELD: physics.

SUBSTANCE: invention relates to a method of recognizing a file as malicious. Method, according to which: file is opened by security device in virtual machine in form of environment for safe execution of files; generating, using a hypervisor interceptor, a log, which stores events occurring during execution of at least one process stream created when opening a file in said virtual machine; generating a security template from a log of a behaviour pattern which consists of those events which are related to safety; monitoring by security means events occurring during execution of at least one process stream created when opening a file on a computer system; the security file recognizes the file as malicious when at least one event is detected, which is related to security and is absent in the specified template.

EFFECT: technical result is to expand the range of means designed to recognize malicious files using means of counteracting analysis in an isolated environment.

7 cl, 4 dwg