DYNAMIC REPUTATION INDICATOR FOR OPTIMIZATION OF COMPUTER SECURITY OPERATIONS Russian patent published in 2020 - IPC G06F21/56 

FIELD: information technology.

SUBSTANCE: invention relates to protection of a computer system from malicious software. Reputation manager operates in a computer system simultaneously with a malware protection mechanism. Reputation manager associates a dynamic reputation indicator with each executable entity, which is considered to be a unique combination of separate components (for example, a main executable file and a set of loaded libraries). Reputation indicator indicates the probability that the corresponding entity is malicious. Reputation of safe entities may increase with time. If the entity performs certain actions that may indicate malicious activity, the reputation of the corresponding entity may be reduced. Malware protection mechanism uses an entity-specific protocol to scan and/or track each target entity for malware, wherein this protocol varies depending on the reputation of the entity. Entities trusted as safe entities can be analysed using a softer protocol, unlike unknown or untrusted entities.

EFFECT: technical result is reduction of computational costs.

22 cl, 1 tbl, 19 dwg