SYSTEMS AND METHODS FOR DETECTING BEHAVIOURAL THREATS Russian patent published in 2022 - IPC G06F21/55 G06F16/35 

FIELD: information security.

SUBSTANCE: invention relates to apparatus and methods for ensuring computer security. The technical result is achieved due to the fact that in the proposed method, the hardware processor of a computer system executes the following stages: assigning a training set of event categories to events; assigning client systems to multiple client clusters in accordance with the event categories; and transmitting the attribution indicator of the client cluster to the anomaly detector configured to determine whether the event corresponds to computer security or a threat; wherein assigning categories to events includes: selecting multiple events occurring in client systems from the training set, forming a sequence of events, and assigning a category to the selected event from the sequence of events in accordance with the preceding event and additionally, in accordance with the subsequent event; wherein attribution of client systems to client clusters includes assigning the client system to the selected client cluster in accordance with the event profile; wherein the anomaly detector is configured to determine whether the event indicates a computer security threat in accordance with the behaviour model trained on a subset of events specific to the client cluster.

EFFECT: increase in the reliability of the system for detecting computer threats.

17 cl, 20 dwg