METHOD AND SYSTEM FOR DETERMINING MALICIOUS ACTIVITY BY ANALYZING THE BEHAVIOUR OF OBJECTS IN NON-INSULATED ENVIRONMENT Russian patent published in 2021 - IPC G06F21/56 

FIELD: computer engineering.

SUBSTANCE: computer-implemented method for determining malicious activity by analyzing the behavior of objects in a non-insulated environment, in which information is collected into an event stream using a detection unit; the event stream is transmitted to a computing device, where the received stream of events is analyzed for a predetermined amount of time. In this case,

in this case, an event from the stream of events is sent to the adapter input, depending on the type of event, wherein the adapter generates its own internal event; the internal event is transmitted to the signature block, where the received internal event is checked according to predefined rules and, if the internal event conforms to predefined rules, a marker of internal state is created. The internal state marker is directed to the input of the malicious activity decision block, where a decision on malicious activity is taken based on the internal state marker of the signature block, and a suspicious activity report is drawn up.

EFFECT: said invention enables identifying malicious activity by analyzing the behavior of objects in non-insulated environment.

10 cl of the formula, 3 dwg