FIELD: computer equipment.
SUBSTANCE: invention relates to the computer equipment. Computer-implemented method of searching for similar malware based on results of their dynamic analysis includes a preparatory step, in which: in an isolated environment, a malicious program is analysed; recording the actions performed by the malicious program in the behavioural report; dividing the accumulated behavioural reports so that the group contains reports containing similar actions and relating to one known malicious family; on the selected fields from the behavioural report a vector of features is created on the given known malicious family; based on each of obtained feature vectors a binary classifier is trained; creating an ensemble of binary classifiers based on previously trained binary classifiers; working stage, at which: analysing a malicious program; recording the actions performed by the malicious program in the behavioural report; trained at preparatory stage ensemble of binary classifiers; ensemble of binary classifiers generates result of calculating probability of ratio of malicious file to this family.
EFFECT: technical result consists in improvement of accuracy of assigning malicious programs to a known family of malicious programs.
8 cl, 3 dwg
