METHOD FOR DETECTING MALICIOUS FILES BASED ON FILE FRAGMENTS Russian patent published in 2021 - IPC G06F21/56 

FIELD: computer technology.

SUBSTANCE: invention relates to the field of computer technology for detecting malicious files based on file fragments. The technical result described below is achieved by selecting a set of data fragments from a file using fragment selection rules, while the data fragment is a continuous, not decompiled sequence of bytes of a fixed-length file; reducing the number of file data fragments in the selected set of file data fragments using rules that reduce the number of fragments; for each piece of data from the selected set, determining the fragment category by searching for a sequence of bytes that contains wildcard characters that matches previously known file fragments; searching for a detection rule that corresponds to a set of malicious file data fragments if the number of fragments from the set that belong to the malicious category exceeds the threshold value; and recognizing the file as malicious based on the application of the found rule.

EFFECT: reduced time required to recognize a file as malicious.

8 cl, 3 dwg