Patent Description:
The rapid growth of computer technologies in the recent decade, and also the widespread use of various computing devices (personal computers, notebooks, tablets, smartphones, and so on), has become a powerful stimulus to the use of those devices in diverse areas of activity and for a large number of tasks (from Internet surfing to bank transfers and electronic document traffic). In parallel with the growth in computing devices and the volume of software running on these devices, the number of malicious programs has also grown at a rapid pace.

A large number of varieties of malicious programs exist at present. Some malicious programs steal personal and confidential data from the devices of users (such as logins and passwords, bank details, electronic documents). Other malicious programs form so-called botnets from the devices of users for attacks such as a DDoS (Distributed Denial of Service) or for sorting through passwords by the method of brute force against other computers or computer networks. Still other malicious programs propose paid content to users through intrusive advertising, paid subscriptions, sending of SMS to toll numbers, and so forth.

Special programs known as antivirus deal quite well with the above-described threats. However, in certain situations said antivirus is practically useless, for example, in targeted cyber-attacks on computer systems (APT - advanced persistent threat), and also when said antivirus is not working on the computer systems when they become infected (for example, the antivirus was not installed or has been turned off).

In this case, in order to ascertain that a computer system is infected, it is necessary to carry out a resource-hungry analysis of the condition of the computer system and analyze the behavior logs of the computer system, the data being received and sent in the computer network, the actions of the users, and so forth. Oftentimes the described measures need to be performed manually, which although increasing their effectiveness significantly increases the labor expense. < <CIT> describes a cyber attack analyzer comprising a storage part for storing plural suspicious activity charts which have a structure for expressing the target type attack and the activity of malware sent from a detection device. <CIT> describes a method and system for utilizing a mapping of activity occurring at and between devices on a computer network to detect and prevent network intrusions. <CIT> describes a data recorder that stored endpoint activity on an ongoing basis as sequences of events that causally relate computer processes and files, and patterns within this event graph can be used to detect the presence of malware on the endpoint. <CIT> describes apparatus and systems that monitor communications between network nodes couples to each other via at least one network, and map the communications to one or more communications graphs which are physically distributed over a plurality of network hosts.

The known technologies handle the tasks of recovering and linking up disparate data gathered in computer systems, but they do not handle the tasks of analysis of the condition of a computer system on the basis of identified relations of that data, on the basis of which the condition in which the computer system being analyzed found itself at a given time or the actions carried out on the computer system at a given time can be analyzed afterwards and the cause of the occurrence of a particular condition of the analyzed computer system or an action performed on the computer system can be determined.

The present disclosure makes it possible to solve the problem of detecting the source of malicious activity on a computer system more effectively.

The present disclosure is designed to provide informational security of data.

The technical result of the present disclosure is to detect a source of malicious activity in a computer system on the basis of an analysis of the relations among objects of that computer system.

In some examples, these results are achieved with the use of a method of detecting a source of malicious activity in a computer system, wherein the method is realized with the aid of components of the system of detecting a source of malicious activity in a computer system and comprises steps in which information is gathered as to the objects of the computer system (hereinafter, "objects"); a graph is formed on the basis of the information gathered on the objects, where the objects appear as the vertices of the graph, and the relations between objects as determined on the basis of the analysis of the gathered information appear as the edges of the graph; at least two induced subgraphs (hereinafter, subgraph) are selected from the resulting graph; the coefficient of harmfulness is determined for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing the strength of the relations between the vertices of that subgraph; from the selected subgraphs, that subgraph is determined whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and the total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum; the object correlated with at least one vertex of the determined subgraph is found to be the source of the malicious activity in the computer system.

In another particular example of the method, the coefficient of harmfulness of the subgraph is determined on the basis of the degree of similarity of that subgraph with at least one subgraph from a database of graphs containing previously formed graphs of malicious activity of the computer system, each of which is associated with a coefficient of harmfulness.

In yet another particular example of the method, the coefficient of harmfulness of a subgraph is a coefficient of harmfulness characterizing the probability that at least one object of those associated with the vertices of the mentioned subgraph is malicious.

In another particular example of the method, only subgraphs related to other subgraphs by graph edges associated with a cause and effect relationship are analyzed.

In yet another particular example of the method, the subgraphs whose diameters are less than a predetermined threshold value are analyzed.

In another particular example of the method, previously unknown objects are selected from the objects found as being the source of the malicious activity.

The present disclosure also provides a system for detecting a source for malicious activity. In one aspect, the system comprises a hardware processor configured to: gather information related to the objects of the computer system; form a graph on the basis of the information gathered on the objects, where the objects appear as the vertices of the graph, and the relations between objects as determined on the basis of the analysis of the gathered information appear as the edges of the graph; select at least two induced subgraphs (hereinafter, subgraph) from the resulting graph; determine the coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing the strength of the relations between the vertices of that subgraph; determine, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and the total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum; identify the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system.

The above simplified summary of example aspects of the disclosure serves to provide a basic understanding of the disclosure. This summary is not an extensive overview of all contemplated aspects, and is intended to neither identify key or critical elements of all aspects nor delineate the scope of any or all aspects of the disclosure. To the accomplishment of the foregoing, the one or more aspects of the disclosure include the features described and particularly pointed out in the claims.

Exemplary aspects are described herein in the context of a system, method, and computer program product for protecting files stored in a network file system. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

The following definitions and concepts are used in describing variant aspects of the present disclosure.

A functional relation is a type of relation (link) between objects whereby changes in each of the objects correspond to each other. In a functional relation, the primary attributes of a causal relationship are absent: productivity (the objects do not produce each other), asymmetry in time (they coexist, one of them does not precede the other), and irreversibility.

<FIG> illustrates a block diagram of the system of detecting malicious activity in a computer system in accordance with exemplary aspects of the present disclosure.

The system <NUM> of detecting malicious activity in a computer system contains a collection module <NUM>, objects of the computer system <NUM>, a trained selection model <NUM>, a graph forming module <NUM>, a graphs database <NUM>, a search module <NUM>, an analysis module <NUM>, a decision <NUM>, and a retraining module <NUM>.

In one example, the collection module <NUM> may:.

For example, the gathering of information about the objects of the computer system <NUM> by the collection module <NUM> may be done with the aid of a specialized driver installed in the computer system, which intercepts the data being transferred between processes, in the network, and so forth.

In one example, the objects <NUM> may comprise at least:.

For example, object <NUM> may constitute a web site address, such as "http://google. com" or "http://files. com/chrome.

In yet another example, the operating system log "system. evtx" consists of entries <NUM>, one example of which is presented below:.

In yet another example, the information about the objects <NUM> comprise at least:.

For example, if there is a file #<NUM> and a file #<NUM> both having been extracted from an archive #<NUM>, then these files are characterized by a size, and also characterized by their time of creation (essentially the time of being extracted from the archive). While the size of the files contains practically no information as to whether the files #<NUM> and #<NUM> are related to each other, the time of creation of these files may indirectly indicate that the files were extracted from an archive (for example, if the times of creation of files #<NUM> and #<NUM> coincide with a given accuracy).

In yet another example, data from the operating system log containing information about the creation of the files, i.e., which process created the file, when and with what name, might indicate a direct relation between file #<NUM> and file #<NUM>, for example, when a process #<NUM> launched from file #<NUM> created file #<NUM>.

In yet another example, the information about the objects <NUM> comprises at least:.

For example, in the operating system registry (which may be viewed as one of the logs of the operating system) the following entry may appear:.

The key in this example is the name of the field "ImagePath", and the value of the key is the pair of values "field type", or "REG_EXPAND_SZ%", and "field value", or "systemroot%\KtknjRrl.

The convolution of data (hash sum) is the result of a processing of data with the aid of a hash function, wherein any given set of data is associated with another set of data of smaller size. In a particular instance, the convolution of data is the check sum of the data (such as CRC32 or MD5).

In yet another example, the relation among objects <NUM> is a logical or functional relation (for example, one in the form of a binary relation) between those objects <NUM>, wherein a logical relation may arise when two objects <NUM> are used jointly (i.e., when the objects <NUM> are used as related objects or at related times, especially at the same time), while they might not be related to each other (for example, a network packet and an event of the operating system "write file to disk"); a functional relation might arise when one object <NUM> is used to analyze another object <NUM> (for example, sites and network packets).

In yet another example, a relation (both functional and logical) is established between two objects <NUM> when a condition is fulfilled, whereby at least:.

The above example described in further detail will appear as follows: upon creating the service, there is performed:.

• writing of the file "KtknjRrl. exe" to hard disk, information about is written into the MFT:.

• writing of data about the operation performed in the event log:.

• writing of data about the service created to the registry:
<IMG>.

All three entries are united by the file name "KtknjRrl. exe", appearing as a common parameter for the MFT (by the ID corresponding to the file "KtknjRrl. exe"), the event log, and the registry.

In yet another example, with the aid of the browser "chrome. exe" the user has downloaded from the site "http://files. com" an archive "drivers. zip", from which with the aid of the application "WinZip" he then extracted the file "driver. In this case, it will be established that the file "driver. sys" is directly related to the file "drivers. zip" and indirectly to the browser "chrome. The objects <NUM> in this example will be the object #<NUM>: the browser "chrome. exe", object #<NUM>: the archive "drivers. zip", object #<NUM>: the file "driver. sys", and object #<NUM>: the site "http://files.

A direct relation between the objects #<NUM> and #<NUM> is established when changes in object #<NUM> or in the behavior of object #<NUM> influence object #<NUM> or the behavior of object #<NUM> (for example, object #<NUM> is an archive and object #<NUM> is a file extracted from the archive), and an indirect relation between object #<NUM> and object #<NUM> is established when between a direct relation exists between object #<NUM> and object #<NUM>, object #<NUM> and object #<NUM> (for example, an indirect relation is established between two files extracted from an archive). It is possible to establish both a direct and an indirect relation between objects at the same time.

In general, the following relations may be identified in the above-described example:.

In yet another example demonstrating the relations between the objects <NUM>, various services of the Windows operating system write data about their working to the operating system log "system. evtx" in the format "[id of entry] [time] [process] [event] [parameters]". For example, the log contains the following entries:.

In this case, it will be established that the process "hsayy. exe" is related to the process "explorer. exe", since a previously established condition relating two different objects <NUM> has been fulfilled: the file identical file "data. dat" has been written and read with a difference of <NUM> seconds.

In yet another example, the degree of reliability of a relation between two objects <NUM> is a numerical value characterizing the probability that one of those objects <NUM> has a logical or functional relation to another of those objects <NUM>.

For example, the degree of reliability of the relation may be a real numerical value in the range of <NUM> to <NUM>, where the value <NUM> means that the objects <NUM> are definitely not related to each other, while <NUM> means that a relation assuredly exists between those objects <NUM>.

Thus, in the case when the degree of reliability of a relation between objects <NUM> is not the maximum possible one (for example, <NUM> from the above-described example), the determination of a relation between the objects <NUM> is probabilistic in nature and oftentimes the relation is not determined strictly, but on the basis of past experience, statistical data on the relation between those objects <NUM>.

For example, the fact that two objects <NUM> created with a difference of <NUM> seconds are related to each other (for example, they were created upon installing software) is a supposition, yet with a high degree of reliability on account of the enormous volume of cumulative statistical data about the working of an operating system and the installing of various software.

In yet another example, the sending of information about the gathered objects <NUM> and the relations found to the graph forming module <NUM> is done only if the degree of reliability of the relation found between the gathered objects <NUM> exceeds a previously established threshold value.

For example, the degree of reliability of a relation may be calculated as follows: Each of the objects #<NUM> and #<NUM><NUM> between which a relation is being established is described by a set of parameters {pi} and {qj} characterizing those objects <NUM>.

In yet another example, the selection of objects <NUM> on which the collection module <NUM> is gathering information and between which relations are being determined may be done with the use of a trained selection model <NUM>. The trained selection model <NUM> is formed in advance with the use of the methods of machine learning, which are known in the prior art, on the basis of a training sample, including computer systems whose behavior is known in advance (malicious or secure), such that the number of selectable objects <NUM> tends to a minimum, while the decision as to the detection of malicious activity pronounced by the analysis module <NUM> on the basis of an analysis of the information about those objects <NUM> and the relations between them tends toward a maximum of accuracy. Such an approach makes it possible to reduce the use of computing resources (memory, processor time, and so on) to determine malicious activity in a computer system, while preserving the accuracy of the decision pronounced.

Since both objects <NUM> (information about the objects) and relations between the objects <NUM> may be used in the following to determine malicious activity in a computer system, it will be convenient to represent the group of selected objects <NUM> and the group of relations found between the selected objects <NUM> as the elements of a graph - a mathematical object for which a broad and multifunctional theory (graph theory) has been developed in the use thereof, and the analysis comes down to the solving of abstract mathematical problems.

A graph is an abstract mathematical object representing an array of graph vertices and graph edges, that is, connections between pairs of vertices. For example, as the array of vertices one may use the array of objects <NUM>, and as the array of edges one may use the array of logical and functional relations between the selected objects <NUM>.

The kinds of graphs for different areas of application may differ in directionality, limitations on the number of relations, and supplemental data on the vertices or edges. Many structures of practical interest in mathematics and computer science may be represented by graphs. For example, a computer system may be modeled with the aid of an oriented graph in which, as mentioned above, the vertices are the objects <NUM> (to be described by a set of parameters representing information about the objects <NUM>), while the arcs (oriented edges) are the logical and functional relations between those objects <NUM>. Furthermore, each vertex (relation) may be assigned a weight (degree of reliability of the relation) and a weighted oriented graph can be formed.

In one example, the graph forming module <NUM> may:.

For example, if the computer system can be represented as a distributed system of clients, in this case graphs for each of the clients are formed on the basis of the objects <NUM> gathered from each client and the relations found between those objects <NUM>.

In one example, the summary graph so formed is optimized in order to reduce the number of edges of the graphs (i.e., the relations between the objects <NUM>).

For example, during the optimization of the graph, there are eliminated from the graph at least:.

In yet another example, the number of intersections of the edges of the summary graph are minimized, where the number of intersections of the edges of a graph (the number of intersections of a graph) is the smallest number of elements in the representation of that graph as a graph of intersections of finite sets or, which is the equivalent, the smallest number of clicks needed to cover all edges of the graph.

In yet another example, the graph forming module <NUM> may:.

In yet another example, the graph forming module <NUM> may form several graphs on the basis of several graphs (at least three), yet fewer than the number of those graphs (at least two) of the summary graphs.

For example, during the analysis of a computer system representing a distributed system (for example, personal computers united into a local area network), several graphs are formed for each computer (essentially an independent element of the computer system). Then, on the basis of the graphs formed for each computer, one summary graph is formed for each computer and the entire set of summary graphs so formed is sent to the search module <NUM>.

In yet another example, in the case when the computer system represents a distributed system, a graph is constructed on the basis of information about the objects <NUM> of that computer system, including the names of the users and their IP addresses contained in the entries of the operating system logs "security. As a result, the following chain of actions (directional graph) is obtained, for example:
user #<NUM> created a file on computer #<NUM> →.

In one example, the graphs database <NUM> is filled up in advance with graphs formed on the basis of objects <NUM> selected from the computer systems and having known malicious activity. These graphs are formed with the use of the above-described collection module <NUM> and the graph forming module <NUM>.

In yet another example, the graphs database <NUM> is filled up with graphs formed on the basis of objects <NUM> selected from the computer systems making up the teaching sample used for the machine learning of the selection model <NUM>.

In yet another example, the graphs database <NUM> stores the convolutions, and not the actual graphs formed by the above-described methods. The search module <NUM> in addition calculates the convolution for the graph obtained from the graph forming module <NUM>, and the search in the graphs database <NUM> is done by comparing the convolution of the calculated convolution of the graph to the convolutions of graphs kept in the database.

In yet another example, a flexible hash (fuzzy hash) is used as the convolution of the graph.

In yet another example, the degree of isomorphism of the graphs is determined and on this basis the degree of similarity of those graphs is determined.

The analysis module <NUM> is designed to pronounce a decision <NUM> on the detecting of malicious activity in the computer system on the basis of the results of the analysis of the graphs obtained from the graph forming module <NUM> and the search module <NUM>.

In one example, the decision on the detecting of malicious activity in the computer system is pronounced on the basis of an analysis of the coefficient of harmfulness of at least one graph found in the graphs database, and the degree of similarity of that graph to the graph formed.

For example, the summary degree of harmfulness of the computer system being analyzed may be calculated by the formula <MAT> where.

In yet another example, the coefficient of harmfulness w of the computer system being analyzed may be present in the range from <NUM> (no malicious activity in the computer system) to <NUM> (there was malicious activity in the computer system). If the mentioned coefficient of harmfulness wm exceeds a predetermined value (such as <NUM>), the decision is pronounced that malicious activity has been detected in the computer system being analyzed.

In yet another example, the object <NUM> which is the source of the malicious activity in the computer system is determined on the basis of an analysis of the graph formed (see <FIG>, <FIG>).

In one example, the retraining module <NUM> may retrain the selection model <NUM> on the basis of the decision <NUM> pronounced by the analysis module <NUM>, such that upon repeat analysis of the same computer system for harmfulness, during the forming of the graphs by the graph forming module <NUM> on the basis of an analysis of the objects <NUM> selected by the collection module <NUM>, at least:.

Let us consider the working of the system of detecting malicious activity in a computer system by the following example:.

The user has performed the following actions in series:.

which in turn was the reason for the following changes in that computer system:.

The collection module <NUM> gathers information on the objects of the computer system <NUM>:.

The graph forming module <NUM> on the basis of the gathered objects <NUM> constructs the relations on the basis of the following data:
object #<NUM> (entry in log) → [relation by user name] →.

<FIG> illustrates a flow diagram of the method of detecting malicious activity in a computer system in accordance with exemplary aspects of the present disclosure.

The flow diagram of the method of detecting malicious activity in a computer system contains step <NUM>, in which information is gathered about the objects of the computer system, step <NUM>, in which the relations between the objects are determined, step <NUM>, in which graphs are formed, step <NUM>, in which a summary graph is formed, step <NUM>, in which graphs are selected, step <NUM>, in which a decision on the malicious activity is pronounced, and step <NUM>, in which the selection model is retrained.

In step <NUM>, information is gathered about the objects of the computer system <NUM>.

In a particular example of the method, the selection of the objects <NUM> for which information is gathered is done with the use of a trained selection model <NUM>.

In step <NUM>, the relations between objects <NUM> are determined on the basis of an analysis of the gathered information, each relation being assigned a degree of reliability of the relation.

In one particular example of the method, the objects <NUM> whose degree of reliability of the relation between them is below a predetermined threshold value are eliminated from further analysis of the computer system for malicious activity (i.e., the objects <NUM> are essentially removed from the graph and not used in the further analysis).

Thus, one achieves a reduction in the computing resources used for the analysis of the computer system for harmfulness.

In step <NUM>, at least two graphs are formed on the basis of the relations found (including the use of the established degree of reliability of the relation), such that the diameter of the graph is less than a predetermined parameter, where the vertices of the graph are the objects <NUM>, and the edges are the relations found.

In step <NUM>, a summary graph is formed on the basis of the graphs formed, such that the summary graph contains at least one vertex from the first and second graph and one edge joining those vertices.

In step <NUM>, at least one graph is selected from the graphs database <NUM> whose degree of similarity to the summary graph formed is greater than a predetermined level, where the graphs database keeps previously formed graphs of the activity of the computer system, each of which is assigned a coefficient of malicious activity on the basis of an analysis of that activity.

In one example, the assigning of the coefficients of malicious activity is done by any method known from the prior art, including on the basis of an analysis of that graph by an analyst.

In step <NUM>, a decision on the detecting of malicious activity in the computer system is pronounced on the basis of the results of the analysis of the formed graph and the selected graph.

In step <NUM>, the selection model <NUM> is retrained on the basis of the decision <NUM> pronounced in step <NUM>, so that upon repeat analysis of the same computer system for harmfulness, during the forming of the graphs in step <NUM> on the basis of an analysis of the objects <NUM> selected in step <NUM>, at least:.

<FIG> illustrates a flow diagram for forming a graph on the basis of an analysis of the relations among the objects of a computer system in accordance with exemplary aspects of the present disclosure.

The diagram for forming a graph on the basis of an analysis of the relations among the objects of a computer system <NUM> contains the initial graphs formed <NUM> and <NUM>, the combined graph <NUM>, and the optimized graph <NUM>, where for each graph the vertices of the graphs are the objects of the computer system <NUM>, <NUM>, <NUM>.

The objects <NUM> may be considered to be different objects (for convenience, they are all designated by the same index, being essentially different), while the objects <NUM> and <NUM> are the same.

The initial graphs <NUM> and <NUM> are formed on the basis of an analysis of the gathered objects <NUM>, <NUM>, <NUM> and the relations identified between them.

In <FIG>, the solid lines denote the functional relations between the objects <NUM>, the dotted lines denote logical relations, and the arrows show linking and linked objects (i.e., the arrow starts from the object <NUM> inducing the relation and goes to the object <NUM> which is related to that object <NUM>). For example, if a file "report. docx" is extracted from a certain archive "data. zip" containing files "report. docx", "report_old. docx", "report_new. docx", the arrow will indicate a functional relation from the archive "data. zip" to the extracted file "report.

For example, the collection module <NUM> is used to gather information about the objects of the computer system <NUM>, where the computer system may consist of several independent components (for example, a client and a server), and the mentioned objects <NUM> gathered from the different independent components may also be viewed as being independent. Thus, several initial graphs will be formed.

In yet another example, the computer system is a unitary one (containing only one independent component), and therefore all the gathered objects <NUM> may be viewed as being dependent; nonetheless, they may also be divided into several relatively independent groups (with a small number of relations), for which several initial graphs (one for each group) will be constructed.

For example, a malicious program is running in the computer system, making possible a remote control of said computer system (backdoor), which may consist of several independent modules (for example, modules working with the disk system, with databases, with memory, with electronic documents, and so forth); receiving commands from a "master", that malicious program may carry out certain malicious or unauthorized actions. In one particular instance, when the malicious program has received two different commands: "encrypt documents" and "get passwords". The two actions will be independent and may be implemented by different modules of the malicious program. In the analysis of such a computer system, <NUM> independent graphs will be constructed, in one of which for the most part the objects <NUM> will be files (documents), while in the other one they will be entries in the operating system logs. Even so, the relation between the two graphs can be tracked by the network activity (which is likewise reflected in the operating system logs), the source of activity (the modules of the malicious program), the time of starting of the activity, the network packets, and so forth.

The graph forming module <NUM> forms the initial graphs <NUM>, <NUM> such that these contain (as vertices) at least two identical or similar objects <NUM> (similar objects are objects differing from each other in at least one parameter by an amount not greater than a specified amount). For example, the initial graph <NUM> contains two identical objects <NUM>.

A combined graph <NUM> is formed on the basis of the previously formed initial graphs <NUM> and <NUM>.

The graph forming module <NUM> forms the combined graph <NUM> such that it includes all identical or similar objects <NUM> present in all the initial graphs on whose basis the combined graph <NUM> is formed. For example, the combined graph <NUM> contains all the objects <NUM>, <NUM> present in the initial graphs <NUM>, <NUM>.

The combined graph <NUM> may be viewed as a summary graph, on the basis of which the search module <NUM> will perform the following analysis of that graph. Even so, for the system of detecting malicious activity in a computer system to be less demanding of computer resources (space in the graphs database, computing resources to form, search for, and analyze graphs, and so on), the graph forming module <NUM> performs an optimization of the combined graph <NUM> and forms the optimized graph <NUM>.

The optimized graph <NUM> is formed on the basis of the previously formed combined graph <NUM>.

The graph forming module <NUM> forms the optimized graph <NUM> such that it includes all the identical or similar objects <NUM> present in all the initial graphs, and in the combined graph. For example, the optimized graph <NUM> contains all the objects <NUM>, <NUM> present in the initial graphs <NUM>, <NUM> and the combined graph <NUM>.

Yet all the objects and relations (vertices and edges) not related to those objects <NUM> can be removed from the optimized graph <NUM> (indicated as clear circles <NUM>).

Thus, after optimization in addition to the mentioned objects <NUM>, <NUM> there may be found objects <NUM> between which a relation is established that was not previously found in the step of forming the initial graphs <NUM>, <NUM>.

The optimized graph <NUM> is already more compact than the combined graph <NUM>, and therefore further work with the use of the optimized graph is more optimal.

<FIG> illustrates a block diagram of the system <NUM> of detecting a source of malicious activity in a computer.

The block diagram of the system <NUM> of detecting a source of malicious activity in a computer system contains the collection module <NUM>, the graph forming module <NUM>, an activity determining module <NUM>, an analysis module <NUM>, and an verdict pronouncing module <NUM>.

The activity determining module <NUM> is designed to:.

In one example, the coefficient of harmfulness of the subgraph is determined on the basis of the degree of similarity of that subgraph with at least one subgraph from the graphs database containing previously formed graphs of malicious activity of the computer system, each of which is assigned a coefficient of harmfulness.

In this case, the subgraph or induced subgraph of a graph is another graph formed from the subset of the vertices of the graph together with all the edges joining pairs of vertices from this subset.

In yet another example, the coefficient of activity of the subgraph is a coefficient of harmfulness characterizing the likelihood that at least one object of those associated with the vertices of that subgraph is malicious.

In one example, the analysis module <NUM> may:.

In one example, the analysis module <NUM> analyzes the subgraphs related to other subgraphs by edges corresponding to a causal relation, i.e., edges corresponding to a logical, and not a functional relation.

In yet another example, the analysis module <NUM> analyzes the subgraphs whose diameters are less than a predetermined threshold value.

The verdict pronouncing module <NUM> is designed to determine the object <NUM> associated with at least one vertex of the subgraph found as the source of malicious activity in the computer system.

In one example, the verdict pronouncing module <NUM> selects previously unknown objects <NUM> as the source of malicious activity.

<FIG> illustrates a flow diagram of the method of detecting a source of malicious activity in a computer system.

The structural diagram of the method of detecting a source of malicious activity in a computer system contains the step <NUM>, in which information is gathered about the objects of the computer system <NUM> (shown in <FIG>), step <NUM>, in which graphs are formed (shown in <FIG>), step <NUM>, in which subgraphs are selected, step <NUM>, in which the coefficient of harmfulness is determined, step <NUM>, in which a subgraph is determined, and step <NUM>, in which the source of malicious activity is determined.

In step <NUM>, information is gathered about the objects of the computer system <NUM> (hereinafter, "objects") with the aid of the collection module <NUM>.

In step <NUM> the graph forming module <NUM> is used to form a graph on the basis of the information gathered about the objects <NUM>, where the vertices of the graph are the objects <NUM>, and the edges are the relations between objects determined on the basis of an analysis of the information gathered.

In step <NUM>, the activity determining module <NUM> is used to select at least two induced subgraphs (hereafter, subgraph) from the graph so formed.

In step <NUM>, the activity determining module <NUM> is used to determine the coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness being a numerical characteristic describing the strength of the relations between the vertices of that subgraph.

In step <NUM>, the analysis module <NUM> is used to determine the subgraph for which:.

In step <NUM>, the verdict pronouncing module <NUM> is used to determine the object associated with at least one vertex of the subgraph determined as the source of the malicious activity in the computer system.

<FIG> is a block diagram illustrating a computer system <NUM> on which aspects of systems and methods for detecting a source of malicious activity in a computer system may be implemented in accordance with an exemplary aspect. It should be noted that the computer system <NUM> can correspond to system <NUM> for example, described earlier. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I<NUM>C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computer-executable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

In an aspect, the storage devices and the corresponding computer-readable storage media are power-independent modules for the storage of computer instructions, data structures, program modules, and other data of the computer system <NUM>.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some aspects, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

In various aspects, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of the skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.

Claim 1:
A method for detecting a source of malicious activity in a computer system, comprising:
gathering, by a hardware processor, information related to the objects of the computer system, the objects including at least one of: a file, network packet, site, a memory page, a process or an event of an operating system, an entry in a log, a master file table or registry of the operating system or an application;
determining by the hardware processor, one or more relations between the objects based on an analysis of the gathered information;
forming, by the hardware processor, a graph based on the information gathered on the objects and based on an assigned degree of reliability of a relation between two objects, where the objects appear as vertices of the graph, and relations between the objects appear as the edges of the graph, and wherein the degree of reliability of a relation between a first object and a second object is a numerical value characterizing probability that the first object has a logical or functional relation to the second object;
selecting, by the hardware processor, at least two induced subgraphs from the resulting graph;
determining, by the hardware processor, a coefficient of harmfulness for each selected subgraph, the coefficient of harmfulness representing a numerical characteristic describing strength of the relations between the vertices of that subgraph;
determining, by the hardware processor, from the selected subgraphs, a subgraph whose coefficient of harmfulness is a minimum among the determined coefficients of harmfulness of the subgraphs, and a total coefficient of harmfulness of the subgraphs related to that subgraph is a maximum; and
identifying, by the hardware processor, the object correlated with at least one vertex of the determined subgraph as a source of the malicious activity in the computer system.