SYSTEM AND METHOD FOR TWO-STAGE CLASSIFICATION OF FILES Russian patent published in 2019 - IPC G06F21/56 

FIELD: physics.

SUBSTANCE: invention relates to the field of detection of malicious files. A method of detecting malicious files comprises steps of: selecting a set of file attributes, which contains at least simple file attributes; simple feature is a feature, the extraction of which does not require significant computational costs; calculating a flexible hash of a file based on the selected set of file attributes; flexible hash is resistant to changes of features from the selected set of features; selecting a classifier corresponding to the calculated flexible hash of the file from the set of classifiers consisting of at least one classifier; classifier corresponds to a flexible hash, when for training classifier used at least files, values of flexible hashes of which coincide with value of said flexible hash; relating the file to one of the file categories using the classifier selected at the previous step; file is considered malicious if it is classified as malicious files.

EFFECT: technical result is reducing the number of errors of the first and second delivery when detecting malicious files.

14 cl, 5 dwg