SYSTEM AND METHOD FOR ACTIVE DETECTION OF MALICIOUS NETWORK RESOURCES Russian patent published in 2022 - IPC G06F21/50 H04L12/40 

FIELD: computer technology.

SUBSTANCE: technical solution relates to the field of computer technology. The expected result is achieved due to the fact that traffic is received by the communication module of the internal device; a suspicious IP address is detected by the analysis module of the internal device; a suspicious device with a suspicious IP address is scanned by the scanning module of the internal device, and a list of running services is obtained; the internal device communication module sends a suspicious IP address and a list of services to an external device; the external device analysis module compares the list of services with known malicious services; if there are such services, the external device notification module creates a report on the detection of malicious activity; in the absence of matches, the analytical module of the external device calculates the ownership interval of the suspicious IP address, and if the interval is less than the threshold value, the suspicious device is considered malicious and a report on malicious activity is created by the external device notification module, if the ownership interval is greater than the threshold value, the suspicious device is considered legitimate.

EFFECT: increase the accuracy of detecting compromise of the protected infrastructure by intruders or malware.

8 cl, 5 dwg