Patent ID: 11880455
Assignee: AO KASPERSKY LAB
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method for selecting a detection model for detection of a malicious file, comprising:
monitoring a file during execution of the file within a computer system by intercepting commands of the file being executed and determining one or more parameters of the intercepted commands,
forming a behavior log of the file being executed containing behavioral data based on the intercepted commands and based on the one or more parameters of the intercepted commands;
forming behavior patterns from the intercepted commands and the one or more parameters selected from the behavior log;
analyzing the behavior log to form a feature vector expressed as a sum of hash sums of elements of a behavior pattern; and
selecting one or more detection models from a database of detection models based on the feature vector, wherein each of the one or more detection models comprises a decision-making rule for determining a degree of maliciousness of the file being executed.