SYSTEM AND METHOD FOR DETERMINING PROCESS ASSOCIATED WITH MALWARE ENCRYPTING COMPUTER SYSTEM FILES Russian patent published in 2022 - IPC G06F21/56 G06N20/00 

FIELD: computer technology.

SUBSTANCE: method for determining the process associated with malware encrypting computer system files (hereinafter – an encryptor) is disclosed, implemented on a computer system processor, containing instructions, according to which: a) using a processing tool, at least one file is determined, into which data was recorded (hereinafter – modification) by the suspicious process based on the processing of system calls used by the suspicious process; b) using the processing tool, characteristics of each mentioned file are determined; c) the modification class of each mentioned file is determined, using an analysis tool, by applying the trained first machine learning model that receives the mentioned file characteristics as input data; d) using the analysis tool, the suspicious process is determined as associated with the encryptor, based on the file modification class determined for each mentioned file.

EFFECT: improvement of the level of protection of computer system files from encryptors, as well as reduction in errors of the first and the second kind, when determining a suspicious process associated with the encryptor.

25 cl, 8 dwg