A computer-implemented method of detecting a remote administration of a computer system , the method comprising: intercepting , via a processor of the computer system, a plurality of events occurring in the computer system; identifying , based at least on determined parameters of each of the plurality of intercepted events, each intercepted event as being related to a first data transfer by an application in a computer network or a second data transfer to the application from a peripheral data input device of the computer system; determining , based on the determined parameters, a first of the identified intercepted events as being dependent on a second of the identified intercepted events; forming a rule defining a dependency of the determined parameters of the first identified intercepted events and the determined parameters of the second identified intercepted event, wherein the rule is formed by: selecting at least one of a matrix form or a vector form to represent the rule; and calculating coefficients for a selected representation of the rule based on the parameters of one of the two intercepted events, and wherein the rule identifies the dependency of the identified parameter of the first identified intercepted event on the identified parameter of the second identified intercepted event; determining a degree of similarity of the formed rule and a previously created rule that defines one or more dependencies of parameters of events occurring in the computer system during the remote administration; when the degree of similarity exceeds a threshold value, identifying at least one application as a remote administration application that created the first and second identified intercepted events; and blocking the identified remote administration application from exchanging data with the computer system. intercepting , via a processor of the computer system, a plurality of events occurring in the computer system; identifying , based at least on determined parameters of each of the plurality of intercepted events, each intercepted event as being related to a first data transfer by an application in a computer network or a second data transfer to the application from a peripheral data input device of the computer system; determining , based on the determined parameters, a first of the identified intercepted events as being dependent on a second of the identified intercepted events; forming a rule defining a dependency of the determined parameters of the first identified intercepted events and the determined parameters of the second identified intercepted event, wherein the rule is formed by: selecting at least one of a matrix form or a vector form to represent the rule; and calculating coefficients for a selected representation of the rule based on the parameters of one of the two intercepted events, and wherein the rule identifies the dependency of the identified parameter of the first identified intercepted event on the identified parameter of the second identified intercepted event; selecting at least one of a matrix form or a vector form to represent the rule; and calculating coefficients for a selected representation of the rule based on the parameters of one of the two intercepted events, and wherein the rule identifies the dependency of the identified parameter of the first identified intercepted event on the identified parameter of the second identified intercepted event; determining a degree of similarity of the formed rule and a previously created rule that defines one or more dependencies of parameters of events occurring in the computer system during the remote administration; when the degree of similarity exceeds a threshold value, identifying at least one application as a remote administration application that created the first and second identified intercepted events; and blocking the identified remote administration application from exchanging data with the computer system. <EOS>