SYSTEM AND METHOD OF DETECTING SOURCE OF MALICIOUS ACTIVITY ON COMPUTER SYSTEM Russian patent published in 2020 - IPC G06F21/56 

FIELD: physics.

SUBSTANCE: invention relates to data security. Method comprises collecting information on computer system objects (hereinafter, objects); generating graph based on collected information on objects, wherein graph vertices are objects, as edges are defined based on analysis of collected communication information between objects; selecting from formed graph at least two generated subgraphs (hereinafter, subgraph); determining a severity index for each selected subgraph, wherein the severity index is a numerical characteristic describing power of links between vertices of said subgraph; determining from the selected subgraphs a subgraph for which the severity index is the minimum of the determined harming severity coefficients of the subgraphs, the total harming severity of the subgraphs associated with said subgraph, is maximum; as a source of malicious activity on a computer system, an object matched with at least one vertex of a defined subgraph is determined.

EFFECT: technical result of the present invention is to detect a source of malicious activity on a computer system based on analysis of links between objects of said computer system.

12 cl, 6 dwg