RU2661533C1 - System and method of detecting the signs of computer attacks - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to computer security. In the method for detecting signs of a computer attack, information about the object on the computer is collected, transmit a security notification to the detection means, including information about the security means and the collected information about the object, while retaining the received security notification in the object database, finding the object contained in the received security notification in the threat database, and add a label corresponding to the object in the threat database to the object database to the object in question, search for suspicious activity signs contained in the database of suspicious activity, based on the received security notification and the added object labels contained in said security notification, when a sign of suspicious activity is found, a label in the database of suspicious activity is added to the database of objects to the security notification, perform detection of signs of computer attack by detecting at least one signature of computer attacks from the database of computer attacks among the received objects, and security notifications, and labels of the mentioned objects, and notifications of security notifications from the object database.

EFFECT: improving the quality of identifying signs of computer attacks on the information system.

32 cl, 8 dwg, 1 tbl

Description

Currently, in addition to traditional malicious software (which, for example, viruses, network worms, keyloggers, ransomware, etc.), computer attacks and, in particular, targeted attacks (also called targeted or targeted attacks) are widely used. targeted attack (TA), as well as complex attacks (Advanced Persistent Threat - APT) on an information system (a set of computing devices and communications used to communicate them, an information system is also called a corporation It’s a huge infrastructure, cybercriminals can have various goals - from simple theft of personal data of employees to industrial espionage.Often, cybercriminals have information about corporate network architectures, principles of internal document management, the means used to protect networks and computer devices, or any other information specific to an information system. This information allows attackers to circumvent existing security features, which often do not have the flexibility to configure etvoreniya all the needs of an information system.

Existing technologies for protection against malicious software (software) and computer threats, such as signature analysis, heuristic analysis, emulation, and others, have a number of disadvantages that do not allow ensuring the proper level of protection against targeted attacks and other computer attacks. For example, they do not allow detecting and investigating previously unknown threats, computer attacks without the use of malicious software, complex attacks (using protection bypass technologies) and long-running attacks (from several days to several years), the signs of which became known after a long time .

Thus, a technical problem arises, consisting in the low quality of determining signs of computer attacks on an information system.

The prior art method for detecting directed attacks (US patent US 9530016), which consists in detecting suspicious executable files on users' computers and in the subsequent sending of these files to the static detection tool. The static detection tool identifies the source and receiver of the potential attack, then decompiles the executable file and executes the decompiled file to identify the data flows between the source and receiver. The data stream may contain, for example, confidential data. In this case, the detection of a directed attack is confirmed.

However, the technology known from the prior art in many cases does not allow identification of a computer attack and its signs, because this requires the transfer of the executable file to the server, and, in addition, many computer and, in particular, targeted attacks take place without the use of malicious software. Thus, the technology presented above does not allow to solve the claimed technical problem. For example, modern targeted attacks can use PowerShell to dynamically create malicious code and load it directly into the computer’s memory without leaving any artifacts on the hard drive — in this case, there are no malware samples, and the PowerShell interpreter itself is not malware. Another example is the use of legitimate tools for malicious purposes: remote administration utilities (LiteManager, TeamViewer, etc.) - for remotely managing compromised computers, legal Windows utilities (bitsadmin, certutil, etc.) - for downloading malware onto compromised computers, administration tools (wmic, psexec, etc.) for remote command launch, lateral movement attack (English lateral movement, lateral movement attack - an attack in which an attacker sequentially breaks user credentials network for obtaining domain administrator credentials) and securing it in a compromised infrastructure.

Disclosure of the invention

The first technical result is the implementation of the appointment.

The second technical result is to improve the quality of determining the signs of computer attacks on an information system in comparison with well-known analogues.

According to an embodiment, a method for detecting signs of a computer attack is used, in which: using at least one security device located in the information system, information is collected about at least one object on the computer; using the protection means, a security notification is transmitted to the detection means, including, in particular, information about the said protection means and collected information about the object, while the detection means stores the received security notification in the object database; using the detection tool, find at least one object contained in the received security notification in the threat database; and using the detection tool, add a label in the object database to the said object corresponding to the object in the threat database; using the detection tool, they search for signs of suspicious activity contained in the database of suspicious activity based on the received security notification and the added tags of the object contained in the said security notification; when a sign of suspicious activity is found, they add to the object database, in particular, a label contained in the database of suspicious activity to the security notification; detect signs of a computer attack by detecting at least one computer attack signature from the computer attack database among the received objects, and security notifications, and marks of said objects, and security notification marks from the object database.

According to one particular embodiment, the object is, in particular, one of: a file; process; Url

According to another particular embodiment, the security measure is, in particular, one of the following: computer security measure; means of protection against targeted attacks.

According to another particular embodiment, with the help of protective equipment, information is collected, in particular, on the following objects: process behavior; events in the operating system; interworking information; indicators of compromise; verdicts of remedy.

According to one particular implementation, the signs of suspicious behavior depend on: tactics, technologies, and procedures of known targeted attacks; information about targeted attacks obtained during penetration tests.

According to another particular embodiment, in particular, the following signs of suspicious behavior are contained: the user first authenticated to the computer; remote start of the object; The operating system log was cleared A file was downloaded over the network from an application that is not a browser; launched files that are not in the white lists from suspicious directories; Deleted shadow copies; renamed remote administration utilities detected; Copy files to the network administrator folder bcdedit.exe utilities were used to disable the system recovery OS component; lsass.exe system process launched a file or modified a file on disk; Run an obfuscated PowerShell script a call to the Windows API function was made; Using the Rundll32 library, files from suspicious paths were launched.

According to another particular embodiment, when a sign of suspicious activity is found, an additional label is added from the database of suspicious activity to the security tool contained in the security notification, and when a computer attack is detected, it is additionally based on a comparison of the security tags with the computer security signatures from a database of targeted attacks.

According to one particular embodiment, the information about the object further comprises, in particular, one of: the checksum of the object or the checksum of its part; the source of the appearance of the object; emulation results of object execution; call log of API functions of the operating system from the side of the object; the time the object appeared in the framework of the computing device; data transmitted over the network by an entity.

According to another particular embodiment, when a tag is added to an object, from the threat database indicating the need to provide the object or additional information about the specified object, the object or additional information about the specified object is requested from at least one security tool using the detection tool, while after receiving the requested object from the protective equipment or additional information about the specified object, the method steps are performed with respect to the newly received object or additional itelnoy information about the specified object.

According to another particular embodiment, when a label is added to the security notification indicating that it is necessary to provide at least one object contained in the security notification or additional information about the specified object, at least one object or additional information about the specified object is requested using the detection tool I have one remedy, and after receiving from the remedy the requested object or additional information about the specified object t steps of the method with respect to the newly received object or additional information about the specified object.

According to one particular embodiment, using the detection tool, a search in the database of objects among objects contained in at least two computers searches for the virus signature from the threat database and, when the virus signature matches the records of the object database, determines the object as malicious and Adds a label to the mentioned object in the object database indicating that the object is malicious.

According to another particular embodiment, a security notification for the detected malicious object is generated using the detection means, containing information about the object and information about the security features on which computers the object is contained.

According to another particular embodiment, information is collected using at least one of the following objects using a security measure: from a list of malicious objects; if the object is not in the list of safe objects and in the list of malicious objects; from the list generated by the administrator of the information system.

According to one particular embodiment, a label is additionally added using security features to an object on a computer, depending on the information about said object collected by said security means and the added label is included in the security notification.

According to another particular embodiment, one of the following marks is added using the security feature: the security judgment; starting a process from the list of suspicious starts; the object is not in the list of safe objects and is not in the list of malicious objects; remote start of the object; The object cleared the system log or OS security log entries. information about the mismatch of the name of the object and its checksum; tags related to the results of the object’s search for external sources of computer attack intelligence; the object is on computers on which files are classified as a keylogger, remote administration tool, monitoring tool, and found on a small number of computers; Unique tasks of the scheduler or settings for autorun or OS or driver service that are not in the list of allowed tasks; violation of the authentication profile on the computer; violations of the network activity profile of the process.

According to another particular embodiment, information about objects on a computer is collected using a security tool for a specified period of time.

According to one of the private implementation options, information is collected using the protection tool about the following objects: from a list of malicious and suspicious objects; which are not in the list of safe objects and in the list of malicious and suspicious objects; from the list of objects generated by the administrator of the information system.

According to an embodiment, a system for detecting signs of a computer attack is used, comprising: an information system that contains at least one computer; at least one security device installed on at least one of the aforementioned computer, and designed to: collect information about at least one object on the computer; transmitting to the detecting means a security notification including, in particular, information about said means of protection and collected information about the object; detection tool connected over the network with the information system and designed to: save security notifications to the database of objects; search for an object from a security notification in the threat database; adding to the database of objects to the object a label corresponding to the mentioned object in the threat database; performing a search for signs of suspicious activity contained in the database of suspicious activity based on the received security notification and the added tags of the object contained in the said security notification; adding objects to the database, in particular, to the security notification of the label contained in the database of suspicious activity when a sign of suspicious activity is found; performing detection of signs of a computer attack by detecting the signature of computer attacks from the database of computer attacks among the received objects, and security notifications, and marks of the mentioned objects, and security notification marks from the database of objects.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

in FIG. 1 is a schematic diagram of the present invention;

in FIG. 2 shows a possible example of modules for computer protection;

in FIG. Figure 3 shows a possible example of modules for defending against targeted attacks;

in FIG. 4 is a diagram illustrating the process of adding labels to objects and security notifications;

in FIG. 5 shows an embodiment of a method for implementing the present invention;

in FIG. 6a and 6b show an example of adding labels to objects and security notifications;

FIG. 7 is an example of a general purpose computer system.

The implementation of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined in the scope of the attached claims.

Glossary

Define a number of terms that will be used to describe embodiments of the invention.

Indicators of compromise (English indicator of compromise, IOC, less commonly infection indicators) - in computer-technical examination, this is the name for artifacts or residual signs of an intrusion into an information system that are observed on a computer or on a network. Typical indicators of compromise are, for example, virus signatures, IP addresses, file checksums, URLs, domain names of botnet command centers that have been detected in known computer attacks. There are a number of standards of indicators of compromise, in particular: OpenIOC (http://blogs.rsa.com/understanding-indicators-of-compromise-ioc-part-i/, http://openioc.org/), STIX (https: //stix.mitre.org/), CybOX (https://cybox.mitre.org), etc.

Computer attack - a lot of hidden and long-term activities carried out by an attacker and aimed at the information system of an organization or individual in order to penetrate the network and cause various kinds of damage to the organization or individual.

Directed attack (also targeted or targeted attack, from the English targeted attack - TA) - a computer attack on the information system of a specific organization or a specific individual with the aim of penetrating the network and causing various kinds of damage to the organization or individual.

A sophisticated attack (Advanced Persistent Threat - APT, also a developed persistent threat or also a targeted attack) is a complex, long-lasting, well-planned multi-path computer attack that uses sophisticated malicious software (software), social engineering methods, and information about the information system of the attacked.

An inaccurate hash (English fuzzy hash) or flexible convolution is a convolution of a file, which is formed in such a way that a small change to the file does not entail a change in convolution. That is, when a malicious file is detected using its convolution value, many similar (possibly unknown) malicious files will also be detected. The main feature of such a convolution is the invariance to small file changes. See, for example, RU 2580036, RU 2614561.

Inaccurate verdict - triggering of a protection tool (anti-virus application) upon detection of suspicious file actions specific to a malicious file. An inaccurate verdict is triggered, for example, when a file is detected using flexible convolution. An inaccurate verdict indicates that the file found is malicious with some probability.

In FIG. 1 is a schematic diagram of the present invention. The information system 100 (also corporate infrastructure) includes a set of computers 101 interconnected by a computer network 105. Computers 101 are generally understood to mean any computing devices and sensors, in particular personal computers, laptops, smartphones, as well as communication devices, such such as routers, switches, hubs, etc. Moreover, the information system 100 can be organized using any topology of the network 105 known from the prior art, for example, one of the following uyuschih types: fully connected, bus, star, ring, mesh, or mixed type. The security features of computers 102 are installed on part of computers 101. It is worth noting that security protection 102 may not be installed on some computers 101. Information system 100 may include means of protection against targeted attacks 103, which can be located, for example, on a separate server. The reputation server 104 may reside in the information system 100 or in the cloud service of the service provider (i.e., be associated with the discovery tool 110). It is worth noting that the computer 101 can be either a physical device or a virtual machine. For connecting computers 101 via the network 105 to the Internet and the detection tool 110, proxies (not shown in the figure) can be used.

The security features of the computer 102 and, optionally, the protection against targeted attacks 103 are used to collect information about objects on the computer 101 and the network 105 - that is, information about suspicious events that are associated with the said objects on the computers 102 and the network 105, and the subsequent transmitting over the network 105 to the detection means 110 (cloud service of the service provider) a security notification including, in particular, information about the security device itself (identifier, etc.) and collected information about the objects. In a particular embodiment, the security notification may also include a time stamp (a point in time or a time interval during which said object information was collected). In a particular embodiment, the object may be, for example, a file (hash of a given file), a process, a URL, an IP address, a certificate, a file execution log, or any other object found on computer 101.

In a particular implementation example, using the means of protection 102-103, in particular, the following information about the objects is collected:

- the behavior of processes (for example, the execution path);

- events in the operating system (OS) - entries in the OS event log;

- information about the interworking;

- indicators of compromise;

- verdicts of the protective equipment or modules of the protective equipment (including inaccurate verdicts) or test signatures;

- object metadata, incl. object checksum.

The means of protection against directed attacks 103 is connected through a network 105 to the means of protecting computers 102 and performs an analysis of the network activity of the information system 100, as well as the function of detecting directed attacks in the information system by detecting objects of computers 101 using, in particular, the sandbox . "Sandbox" - a computer environment for the safe execution of processes) and other detecting technologies (see details in Figs. 2-3).

The means of protection against targeted attacks 103 collects information transmitted in network traffic. Thus, the means of protection against targeted attacks 103 collects information about all objects transmitted over the network 105 from computers 101, including those computers 101 on which the means of protection 102 are not installed.

Information about objects on the network 105 may include verdicts of means of protection against targeted attacks 103, suspicious behavior in network traffic, in DNS traffic, results of emulation of objects from mail or the Internet.

In a particular embodiment, the protective equipment 102-103 collect information about all of the above objects. In another embodiment, the protection means 102-103 may contain a list of safe (legitimate) objects (of which it is known for certain that they are not malicious and suspicious) and a list of malicious and suspicious objects (not shown in the figure). In this example, protection means 102-103 collect information not only about objects from the list of malicious and suspicious objects, but also information about unknown objects (which are not in the list of malicious and suspicious objects, as well as in the list of safe objects).

In another example implementation, the protective equipment 102-103 may contain a list of additional objects about which it is necessary to collect information. Such a list of objects can be generated, for example, by the administrator 106. In another particular implementation example, the administrator 106 can create a list of malicious and suspicious objects and a list of safe objects by adding or excluding objects from these lists.

For example, administrator 106 may specify a list of prohibited actions and a list of allowed actions. For example, in the information system 100, the use of the psexec utility may be prohibited on parts of computers 101, because it can be used by attackers for remote administration. Information about objects associated with prohibited actions is collected by means of protection 102-103. Thus, if psexec utility has been detected on any computer 101 or network 105, the usage information will be transmitted to the detection tool 110, on which the corresponding label will be added. Moreover, the lists of allowed and prohibited actions can be stored both in the information system 100 and in the detection tool 110. If the security tool 103 detects the use of the psexec utility on the computer 110 on which the security tool 102 is not installed, check the validity of the use of psexec on this computer and adding the appropriate label can be done both by means of protection 103 and by means of detection 110 using a list of prohibited actions. In another particular implementation example, if there is no information in the list of prohibited actions and in the list of allowed actions, the analytical center 115 may check with the administrator 106 whether the detected action is valid and, if such an action is not valid, add the appropriate label.

Detector 110 stores the received security notification in the object database 112, and then searches for objects from the threat database 111 in the received security notifications. When an object is found from the security notification in the threat database 111, the detection tool 111 adds the label corresponding to it in the threat database 111 to the found object database 112. The match can be determined, for example, by matching the checksum of the object in the threat database 111 and in the database of objects 112.

An object label is a characteristic of an event occurring on a computer 101 associated with a found object or an action performed by or on an object. Thus, the label of the object will be added to the object if and only if a certain event has occurred on the computer 101 or a specific action has been performed related to the object. In a particular embodiment, the object’s labels characterize, for example, the verdicts of the protection means 102-103 and information about the suspicious behavior of the object (based on information about the object). Thus, the label of an object includes, in particular, the following events (hereinafter, it is understood that the label will be added to the object only when the indicated events associated with this object, detected on the basis of the received information about the object, occur on computer 101) :

- substitution of the DNS server on the computer;

- disabling automatic updating of the operating system;

- disable the firewall;

- disable protection;

- Disabling UAC (Eng. User Account Control, UAC - component of the Windows OS, User Account Control).

In yet another particular implementation example, object labels added to the object by the detection tool 110 may further include the following events:

- information about the mismatch of the name of the object and its checksum (for example, the executable file, which is an application for remote access - TeamViewer, has been renamed);

- violation of the authentication profile on the computer (within a specified period of time (one, two or more days), during which information about the object was collected, a certain list of users was authenticated on computer 101, and now a user who is absent on computer 101 was authenticated in the specified list);

- violation of the profile of the network activity of the process (for a specified period of time (one, two or more days), during which information about the object was collected, the process interacted over the network with a specific list of Internet IP addresses, after which the process contacted the network with IP address not in the specified list);

- tasks of the scheduler / autostart settings / OS service / driver settings that are unique within this information system 100 and are not in the list of allowed tasks;

- tags associated with the object’s search results by external sources of computer attack intelligence (eng. cyber threat intelligence or threat intelligence);

- computers 101 on which files are classified as a keylogger (English keylogger), a remote administration tool (English remote admin tool), a monitoring tool (English monitor), and found on a small number of computers 101.

In a particular implementation example, if the object is not contained in the list of malicious objects, a flexible convolution can be calculated for it using detection tool 110. Then it can be checked whether any malicious objects correspond to this flexible convolution, and if the answer is yes, the original object will also be marked as malicious. In addition, a verdict for protector 102 can be created and transmitted for this file.

Using the detection tool 110, they search for signs of suspicious activity (i.e., characteristic signs of computer attacks) in the database of suspicious activity 113 based on the received security notification and the added tags of the object contained in the security notification. When a sign of suspicious activity is found, a tag contained in the database of suspicious activity 113 is added using the detection tool 110, in particular to the security notification. The tag indicates the presence of a found sign of suspicious activity. Then, signs of a computer attack are detected by detecting the signature of the computer attacks from the database of computer attacks 114 among the received objects and security notifications and labels of said objects and security notifications from the database of objects 112.

A sign of a computer attack means the fulfillment of the conditions necessary to initiate a detailed investigation and confirm or refute a targeted attack by the analytical center 115. In a particular implementation example, when detecting the sign of a computer attack, one can unequivocally confirm not only the signs of a computer attack, but also the detection of a computer attack without the need for an investigation by the think tank 115. In another implementation example, when identifying computer signatures attacks cannot be unambiguously confirm the targeted attacks, and in this case, an additional investigation by the analytical center 115 will be required.

Both objects and security notifications are appended with tags that are characteristics of the event that occurred on computer 101 (computer 101, from which information contained in the security notification was collected) or the action that occurred on the computer. Thus, the label will be added to the security notification if and only if a specific event has occurred on computer 101 or a specific action has been performed that falls within the sign of suspicious activity.

Labels for security notifications may include signs of suspicious activity, which in turn are, in particular, the following:

- the user first performed authentication on the computer; An example of a scenario for the occurrence of such a suspicious event is as follows. Within a month, the protection means 102 collects a list of user accounts (accounts) successfully authenticated on the computer 101. Then, the user with the account that is not in the generated list of accounts is authenticated on the computer 101;

- made remote start of the object (file / process);

An example of a scenario for the occurrence of such a suspicious event is as follows. The object was launched remotely using the Windows Management Instrumentation (WMI) infrastructure or through Windows OS services;

- Deleted entries in the event log;

- a file was downloaded over the network from an application that is not a browser;

- Launched files that are not in the white lists from suspicious directories;

- Shadow copies were deleted (for example, using the vssadmin.exe utility - this is typical of many malicious encryption programs to make system recovery difficult);

- Found renamed remote administration utilities (AmmyyAdmin, Team Viewer, etc.);

- files were copied to the administrator’s network folder (C $, ADMIN $);

- bcdedit.exe utilities were used to disable the OS system recovery component (Eng. System startup repair);

- the system process lsass.exe launched the file or modified the file on disk;

- executed obfuscated PowerShell script;

- a call was made to the Windows API function;

a suspicious PowerShell command was executed - a call to the Windows API functions;

- Using the Rundll32 library, files from suspicious paths were launched.

In a particular implementation example, part of the labels for objects and labels for security notifications (and, accordingly, signs of suspicious activity) may coincide. For example, a mismatch between the name of the object and its checksum may be a sign of suspicious activity, or it may be added as a label to the object.

The signature of a computer (in a particular example, targeted) attack is a set of the following entries: a list of objects, security notices, and labels of the mentioned objects and security notifications that are characteristic of specific computer attacks and, in particular, for targeted attacks. Thus, when finding a certain combination of records from the signature of a directed attack, it is possible to claim the detection of an attack (or its signs). In one particular embodiment, the computer attack signature contains at least one object record, at least one security notification record, at least one object label, and at least one security notification label. In another particular implementation example, a computer attack signature may contain only one or more of the mentioned records — for example, a record about one object or a record about an object and an object’s label. In yet another particular embodiment, the computer attack signature comprises at least one security notification label.

To detect all kinds of signs of suspicious activity (violation of the network activity profile of a process, computer, violation of the network inputs profile, etc.), a machine-learning system without a teacher can be used - the system itself is trained on the basis of incoming security notifications and affixed tags. After training, the system will label security notifications for which there is no label in the database of suspicious activity 113. In addition, a machine learning system with a teacher can be used to solve the problem of classifying the behavior of a process or computer. The factors are signs of suspicious activity, and training is conducted on data for known detected computer attacks.

The database of objects 112 is used to store security notifications containing information about objects, as well as added labels to objects and labels to security notifications.

Threat database 111 contains data on known threats. In particular, the threat database 111 contains identifiers and information about objects that are signs of threats. Each object in the threat database 111 is marked with the corresponding label. For example, a malicious object might be labeled “malicious object”. If an object was used in a specific targeted attack, an appropriate label will be assigned to it.

For example, consider the well-known directional attack "Turla". Known URLs are associated with it. And thus, if the object, which is the executable file, accessed the mentioned address, a label indicating the corresponding action will be added to this object. For example, the label "access to the URL associated with APT Turla."

In another example, a known set of IP addresses is associated with the Naikon APT targeted attack, and if the object accessed this address, the label “access the IP address associated with Naikon ART” will be added to the object.

Suspicious activity database 113 contains a list of signs of suspicious activity. In addition, each sign of suspicious activity is marked with a special label indicating which directed attack the indicated sign of suspicious activity is associated with (examples of signs of suspicious activity were given earlier).

In a particular implementation example, if an object is marked with a certain set of labels, an additional label can be added to the specified object, indicating this feature. Thus, a plurality of tags can also be tagged.

The database of computer attacks 114 contains a list of signatures of computer or targeted attacks.

In FIG. Figure 2 shows a possible example of modules for computer protection. The computer protection tool 102 may contain modules designed to ensure the security of the computer 101: an on-access scanner, an on-demand scanner, mail antivirus, web antivirus, proactive protection module, HIPS module (Host Intrusion Prevention System), DLP -module (born data loss prevention), vulnerability scanner, emulator, firewall, etc. In a particular implementation example, these modules can be an integral part of security tool 102. In another example implementation, these modules could These are implemented as separate software components.

The access scanner contains functionality for detecting malicious activity of all opened, launched and saved files on the user's computer system. The on-demand scanner differs from the access scanner in that it scans user-specified files and directories on demand.

Mail antivirus is required to control incoming and outgoing e-mail for the content of malicious objects. Web antivirus is used to prevent the execution of malicious code that may be contained on websites when they are visited by the user, as well as to block the opening of websites. The HIPS module serves to detect unwanted and malicious activity of programs and block it at the time of execution. The DLP module is used to detect and prevent confidential data from leaking out of a computer or network. Vulnerability scanner is required to detect vulnerabilities on computer 101 (for example, some components of protection tool 102 are disabled, outdated virus databases, the network port is closed, etc.). The firewall monitors and filters network traffic in accordance with the specified rules. The emulator works by simulating the guest system while the code is running in the emulator. The proactive defense module uses behavioral signatures to detect the behavior of executable files and classify them by trust level.

When the detected modules detect malicious software (suspicious behavior, spam, and other signs of a computer threat), they create a corresponding notification (which can then be converted to the verdict of protection means 102), indicating to the protection means about the detected threat and the need to take actions to eliminate the threat ( for example, deleting or modifying a file, prohibition of execution, etc.). In a particular implementation example, the module itself that detects malware can take actions to eliminate the threat. In another example, the verdict may be inaccurate or test (since this verdict can give false positives) - in this case, the security measure will not take action to eliminate the threat, but will send a notification to the detection tool 110. It should be noted that the verdict means of protection 102 is part of the information about the object (file, process), which will then be transmitted to the detection means 110 in the form of a security notification.

In FIG. Figure 3 shows a possible example of protection against attack modules. The means of protection against targeted attacks 103 may contain, for example, the following protection modules: a sandbox, an intrusion detection system (IDS), a reputation service, a YARA rule checking module, and other detection modules.

The sandbox module has a functionality similar to the emulator of the computer protection tool 102 with the difference that the sandbox can use additional computing power and work longer, since the protection against directed attacks 103 has no time limits inherent in the computer protection tool 102 .

The Sandbox is a computer environment for the safe execution of processes and is used to determine suspicious activity during the execution of a process launched from a file.

A “sandbox” can be implemented, for example, in the form of a virtual machine, based on partial virtualization of the file system and registry, based on access rules to the file system and registry, or based on a mixed approach.

An intrusion detection system is a means of detecting unauthorized access to a computer system 101 or network 105 or unauthorized control thereof.

The reputation server can be a mirror or a cached copy of the reputation server 104 and, in addition, contains information about the popularity of objects on computers 101 (the number of computers 101 on which there is an object, the number of object launches, etc.).

The YARA rule validation module is used to validate YARA signatures, an open signature format (see http://yararules.com/).

The DLP module is used to detect and prevent confidential data from leaking out of a computer or network.

TI analyzer (English threat intelligence - threat intelligence) is a module that compares objects from computer attack reports with information about objects and with signs of suspicious behavior. For example, the TI analyzer can determine the list of IP addresses of command centers involved in known computer attacks. The TI analyzer passes the received information to the scoring module, which ranks information about objects and signs of suspicious behavior by the probability of their belonging to a computer attack.

In FIG. 4 is a diagram illustrating the process of adding labels to objects and security notifications. So, at least one of the protections 102-103 collects information about the object 401 and transmits a security notification 402 to the detection tool 110. The detection tool 110 extracts the object 401 from the received security notification 402 and searches for the object 401 in the threat database 111 (Level 1 ) If the search result is positive, the detection tool 110 adds a tag 410 corresponding to this object 401 to the threat database 111. In one particular embodiment, when tags are added to the object 401, the collected information about this object is taken into account. For example, if an object 401 was detected on the computer that corresponds to certain indicators of compromise (specified in the threat database 111), a label will be added to it, if the same object 401 was found, however, certain indicators of compromise were not found, there is no a label will be added. Further, the detection tool 110 searches for signs of suspicious activity (Level 2) contained in the database of suspicious activity 113, based on the received security notification 402 and the added tags 410 of the object 402. When a sign of suspicious activity is found, the detection tool 110 adds 112 to the database of objects. in particular to security notification 402, tag 411 contained in the suspicious activity database 113.

As a result, the detection tool 110 performs a directed attack detection (Level 3) 403 by detecting the signatures of targeted attacks from the database of computer attacks 114 among the received objects 401, security notifications 402 and tags to objects 410 and to security notifications 411 from the database of objects 112.

In a particular implementation example, when a computer attack is confirmed, information will be transmitted to the analytical center 115, which, in turn, will notify the administrator 106 of the information system 100 of the detected attack using, in particular, telecommunication network 120 or network 105.

In another particular implementation example, to confirm a computer attack, the information will also be transmitted to the analytical center 115, which, in turn, will notify the administrator 106 of the information system 100 of the detected attack using, in particular, telecommunication network 120 or network 105. And, if the administrator 106 will report that the actions that led to the identification of the signature of a computer threat are legitimate, a computer attack will be denied.

However, if the administrator 106 reports that the actions that led to the identification of the signature of the computer threat are not allowed, and if one or more entries from the database of objects 112 are not enough to identify the signatures of targeted attacks from the database of computer attacks 114, using the analytical center 115, additional information may be requested from the administrator 106. Additional information may include, in particular, files of one or more computers 101, records of security logs 1 02 (for example, a firewall log or a proactive defense module log), a memory dump of one or more computers 101, a dump of the disk of one or more computers 101.

Table 1 below shows examples of requesting additional information by analytical center 115 from administrator 106.

For example, if the virus signature contains an inaccurate verdict on the memory, then a memory dump will be required to confirm a computer attack (example 1). Other examples are described in detail in table 1.

In a particular implementation example, the signs of suspicious activity depend on the tactics, technologies, and procedures (Tactics, Techniques and Procedures, TTP) of computer and, in particular, targeted attacks.

We give an example of TTR. The user received an office document as an attachment by mail. The document contained a macro, the user agreed to run it. The launched macro launched the PowerShell interpreter, which downloaded Base64 encoded content from the site and ran it without creating any files on the disk. The launched code was executed in the context of the PowerShell process and performed pinning in the computer system by creating an entry in the registry HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run, ensuring that this code is run whenever the user logs in. This code was a renamed TeamViewer client, through which an attacker made remote access to a compromised system.

In this example, the following signs of suspicious activity will work:

- launch of the PowerShell interpreter from the office application;

- a heuristic inaccurate verdict on obfuscating PowerShell parameters (compression, BASE64 encoding, etc.);

- HTTP request from the PowerShell interpreter;

- the site from which the attachment was downloaded was previously detected in the distribution of malware (contained in the list of malicious objects);

- the access scanner issued an inaccurate verdict on the loaded attachment (for example, by similarity - the result of working out a flexible convolution);

- Using a reputation server, a low reputation or popularity of a downloaded attachment was obtained;

- protection tool 102 issued an inaccurate / accurate verdict when scanning the PowerShell process memory after downloading malicious content from the site;

- PowerShell modified registry keys for autorun;

- for a file specified in autorun, the hash does not match the name (for example, the hash of the file corresponds to the hash of the Team Viewer application, and the file name is different).

In yet another example of implementation, the signs of suspicious activity depend on information about targeted attacks received during penetration tests (eng. Penetration test, in abbreviated form - pentest). For example, an SMB vulnerability penetration testing group received privileged access to the administrator’s computer, where it created a dump of the lsass.exe process using a legal utility. Authentication data was extracted from the dump, which was then used to access other computers on the network, from which memory dumps were also obtained, and authentication data was also extracted. The process was repeated many times until access to the authentication credentials of the Windows domain administrator was obtained.

Examples of signs of suspicious activity are listed previously in the description of FIG. one.

In FIG. 5 shows an embodiment of a method for implementing the present invention. At step 501, the protection means of the computer 102 and / or the means of protection against targeted attacks 103 collects information about objects (for example, files, processes) on the computer 101. Next, at step 502, the said means of protection transmit to the detection means 110 a security notification that includes, in particular, information about the protective equipment itself and information collected about the object. In this case, the detection means 110 stores the received security notification in the database of objects 112.

In step 503, the detection tool 110 searches for objects from security notifications in the threat database 111. To the found objects in step 504, the detection tool 110 adds tags 112 to the objects database corresponding to this object in the threat database 111. In step 505, the detection tool 110 searches for signs of suspicious activity contained in the database of suspicious activity 113 based on the received security notification and the added tags of the object contained in the security notification. At step 506, when a sign of suspicious activity is found, the detection tool 110 adds the label contained in the database of suspicious activity 113 to the security notification, in particular.

At step 507, the detection tool 110 performs detection of signs of a computer attack by detecting the signature of computer attacks from the database of computer attacks 114 among the received objects, and security notifications, and marks of the mentioned objects, and security notification marks from the database of objects 112. After detecting signs of a computer attack the subsequent investigation of the attack will be carried out by computer security specialists from the analytical center 115, who interact with the administrator 106. In a particular example, When detecting signatures of computer attacks, it is possible to unequivocally confirm the detection of not only signs of a computer attack, but also confirm the detection of a computer attack without the need for an investigation by the analytical center 115. In another example of implementation, when detecting the signature of computer attacks, it is impossible to unequivocally confirm the directed attack, in which case further investigation by the think tank 115 will be required.

Thus, a technical problem will be solved, consisting in the low quality of determining the signs of computer attacks on an information system and the claimed technical results will be achieved. Namely, the purpose has been implemented, and the quality of determining the signs of computer attacks on the information system has been improved compared to well-known counterparts by identifying the signatures of computer attacks among received objects, and security notifications, and marks of the mentioned objects, and security notification marks from the database of objects.

It is worth noting that some attacks, including targeted attacks, can be detected by means of protection 102-103, in which case the method of FIG. 5 will be completed, and the attack will be prevented by means of protection 102-103 (by deleting the files used in the attack, blocking traffic and other actions).

In a particular embodiment, at step 501, the protective equipment 102-103 collects, in particular, information about such objects:

- process behavior;

- events in the operating system;

- information about the interworking;

- indicators of compromise (IOC);

- verdicts of the protective equipment (examples of modules are shown in Figs. 2-3).

In a particular embodiment, when a sign of suspicious activity is found, a label from the database of suspicious activity is additionally added to the security tool, the information about which is contained in the mentioned security notification, and when performing a directed attack detection, they are additionally based on comparing the issued tags to the said security tool with computer attack signatures from the database of computer attacks 114

In another particular embodiment, the information about the object further comprises, in particular, one of:

- the checksum of the object or its part (for example, the checksum of the file or its part) - for example, CRC, hash functions: MD5, SHA-1, SHA-2, Kessak, GOST R 34.11-2012 and others;

- the source of the appearance of the object (for example, the IP address of the resource from which the object was downloaded);

- The results of the emulation of the execution of the object;

- a call log of API functions of the operating system from the side of the object (if the object is a process);

- the time of the appearance of the object within the computing device;

- data transmitted over the network by the object.

In yet another particular embodiment, when at step 502, from the threat database 111, a label is added to the object that indicates the need to provide the object or additional information about the specified object, at least one object or additional information is requested from the detection tool 110 from at least one means of protection 102-103, while after receiving from the means of protection of the requested object or additional information about the specified object, steps 503-504 are performed with respect to the newly received object or more information about the specified object.

In another particular embodiment, when a label is added to the security notification in step 506 indicating that it is necessary to provide at least one object contained in the security notification or additional information about the specified object, the object or additional information about the specified object is requested using the detection tool at least one means of protection of the information system 100, and after receiving from the means of protection of the requested object or additional information about The indicated object performs steps 503-506 with respect to the newly received object or additional information about the specified object.

In FIG. 6a and 6b show an example of adding labels to objects and security notifications according to the method described in FIG. 5.

So, in step 502, after the detection means 110 receives security notifications from the security means, the detection means 110 stores the security notifications in the object database 112. In this example, four security notifications about two objects were received (see the state 601 of the object database 112 in FIG. . 6a).

In step 503, the detection tool 110 searches for objects from security notifications in the threat database 111. In this example, only object 1 is contained in the threat database 111. Object 1 corresponds to the object labels MO1, MO4, MO5, which will be added to the database in step 504 the data of objects 112 by the detection means 110. As a result, the database of objects 112 will assume a state of 602.

At step 505, the detection tool 110 searches for signs of suspicious activity contained in the database of suspicious activity 113, based on the received security notification and the added tags of the object information about which is contained in the security notification (i.e., for the database of objects 112 in state 602 ) In this example, a match will be found for the first and second signs of suspicious activity from the database of suspicious activity 113. Thus, at step 506, notification label MU1 from the database of suspicious activity 113 will be added to notification 2 for object 1, and for notification 4, the label MU2 notifications. The database of objects 112 will assume state 603 in FIG. 6b.

At step 507, the detection tool 110 performs detection of signs of a computer attack by detecting the signature of the computer attacks from the database of computer attacks 114 among the received objects and security notifications and labels of said objects and security notifications from the database of objects 112 (state 603). In this example, the first signature of a computer attack will be detected, because the object database 112 simultaneously contains object 1 and the label MO1 and notification 2 and the notification label MU1 (i.e., the first signature is contained). In addition, a second signature will be detected. Thus, in the database of objects 112 two signatures will be detected at once, indicating the presence of signs of a computer attack in the information system 100.

FIG. 7 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 7. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes, may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks (also - information systems), internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In accordance with the description, components, execution steps, data structure described above can be performed using various types of operating systems, computer platforms, programs.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims.

Claims (146)

1. A method for detecting signs of a computer attack, in which: a) using at least one security device located in the information system, collect information about at least one object on the computer; b) using the protection means, the security notification is transmitted to the detection means, including, in particular, information about the said protection means and the collected information about the object, while the detection means stores the received security notification in the object database; c) using the detection tool, find at least one object contained in the received security notification in the threat database; and d) using a detection tool, add a label in the database of objects to the mentioned object corresponding to the mentioned object in the threat database; e) using the detection tool, they search for signs of suspicious activity contained in the database of suspicious activity based on the received security notification and the added tags of the object contained in the said security notification; f) when a sign of suspicious activity is found, add a label in the database of suspicious activity to the security notification, in particular; g) perform detection of signs of a computer attack by identifying at least one computer attack signature from the database of computer attacks among the received objects, and security notifications, and marks of the mentioned objects, and security notification marks from the database of objects. 2. The method according to p. 1, in which the object is, in particular, one of: - file; - process; - URL. 3. The method according to p. 1, in which the protective equipment is, in particular, one of the following: - computer protection tool; - a means of protection against directed attacks. 4. The method according to p. 3, in which using protective equipment collect, in particular, information about the following objects: - process behavior; - events in the operating system; - information about the interworking; - indicators of compromise; - verdicts of a remedy. 5. The method according to p. 1, in which the signs of suspicious behavior depend on: - tactics, technologies and procedures of known targeted attacks; - information about targeted attacks obtained during penetration tests. 6. The method according to claim 1, which contains, in particular, the following signs of suspicious behavior: - the user first performed authentication on the computer; - made a remote launch of the object; - the operating system log was cleared; - a file was downloaded over the network from an application that is not a browser; - Launched files that are not in the white lists from suspicious directories; - Deleted shadow copies; - Found renamed remote administration utilities; - Files were copied to the administrator’s network folder; - bcdedit.exe utilities were used to disable the OS system recovery component; - the system process lsass.exe launched the file or modified the file on disk; - executed obfuscated PowerShell script; - a call was made to the Windows API function; - Using the Rundll32 library, files from suspicious paths were launched. 7. The method according to p. 1, in which, when a sign of suspicious activity is found, an additional label is added from the database of suspicious activity to the security tool contained in the security notification, and when performing a computer attack detection, they are additionally based on a comparison of the exposed tags to the security tool with signatures of computer attacks from a database of targeted attacks. 8. The method according to p. 1, in which information about the object further comprises, in particular, one of: - the checksum of the object or the checksum of its part; - the source of the appearance of the object; - The results of the emulation of the execution of the object; - a log of calls to the API functions of the operating system from the side of the object; - the time of the appearance of the object within the computing device; - data transmitted over the network by the object. 9. The method according to claim 1, wherein when adding a tag to the object in step b), from the threat database indicating the need to provide the object or additional information about the specified object, they use the detection tool to request the object or additional information about the specified object by at least one means of protection, and after receiving the requested object from the protection means or additional information about the specified object, the steps c) -d) of the method are performed with respect to the newly obtained object or additionally th information about the specified object. 10. The method according to claim 1, in which when adding to the security notification in step e) a label indicating the need to provide at least one object contained in the security notification or additional information about the specified object, using the detection tool, they request the object or additional information about the specified object at least one of the means of protection, while after receiving from the means of protection of the requested object or additional information about the specified object, perform steps c) -f) Both with respect to the newly obtained object or additional information about the specified object. 11. The method according to p. 1, in which, using the detection tool, search in the database of objects among objects contained in at least two computers, the virus signature from the threat database, and if the virus signature matches the object database records, the object is determined as malicious and add a label to the mentioned object in the database of objects indicating that the object is malicious. 12. The method according to claim 11, in which a security notification for the detected malicious object is generated using the detection means, containing information about the object and information about the security features on which computers the object is contained. 13. The method according to p. 1, in which information is collected using at least one of the following objects: - from the list of malicious objects; - if the object is not in the list of safe objects and in the list of malicious objects; - from the list generated by the administrator of the information system. 14. The method according to claim 1, in which, in step a), a label is added to the object on the computer using a security tool depending on the information about the object collected by the security tool, and in step b) the added label is added to the security notification. 15. The method according to p. 14, in which one of the following labels is added using the protective equipment: - the verdict of the remedy; - starting a process from the list of suspicious launches; - the object is not in the list of safe objects and is not in the list of malicious objects; - remote launch of the object; - the object cleared the entries in the system log or OS security log; - information about the mismatch of the name of the object and its checksum; - tags associated with the object’s search results using external sources of computer attack intelligence; - the object is on computers on which files are classified that are classified as keyloggers, remote administration tools, monitoring tools, and are found on a small number of computers; - tasks of the scheduler or settings of autorun, or OS service, or driver, unique in the information system, that are not in the lists of allowed tasks; - violation of the authentication profile on the computer; - violations of the network activity profile of the process. 16. The method according to p. 1, in which, at step a), information is collected about the objects on the computer using a security device for a specified period of time. 17. The method according to p. 1, in which information is collected using the protective equipment about the following objects: a) from the list of malicious and suspicious objects; b) which are not in the list of safe objects and in the list of malicious and suspicious objects; c) from the list of objects formed by the administrator of the information system. 18. A system for detecting signs of a computer attack, comprising: a) an information system that contains at least one computer; b) at least one protective device installed on at least one of the aforementioned computer and designed to: - collecting information about at least one object on the computer; - transmitting to the detection means a security notification including, in particular, information about said protection means and collected information about the object; c) a means of detection connected over the network with the information system and intended for: - save security notifications to the database of objects; - search for an object from a security notification in the threat database; - adding to the database of objects to the object a label corresponding to the mentioned object in the threat database; - performing a search for signs of suspicious activity contained in the database of suspicious activity based on the received security notification and the added tags of the object contained in the said security notification; - adding objects to the database, in particular, to the security notification of a label contained in the database of suspicious activity when a sign of suspicious activity is found; - performing detection of signs of a computer attack by detecting the signature of computer attacks from the database of computer attacks among the received objects, and security notifications, and labels of the mentioned objects, and security notification labels from the database of objects. 19. The system of claim 18, wherein the object is, in particular, one of: - file; - process; - url. 20. The system of claim 18, wherein the security measure is, in particular, one of the following: - a means of protecting computers; - a means of protection against directed attacks. 21. The system according to p. 20, in which using protective equipment collect, in particular, information about the following objects: - process behavior; - events in the operating system; - information about the interworking; - indicators of compromise; - verdicts of a remedy. 22. The system of claim 18, wherein the signs of suspicious behavior depend on: - tactics, technologies and procedures of known targeted attacks; - information about targeted attacks obtained during penetration tests. 23. The system of claim 18, which contains, in particular, the following signs of suspicious behavior: - the user first performed authentication on the computer; - made a remote launch of the object; - the operating system log was cleared; - a file was downloaded over the network from an application that is not a browser; - Launched files that are not in the white lists from suspicious directories; - Deleted shadow copies; - Found renamed remote administration utilities; - Files were copied to the administrator’s network folder; - bcdedit.exe utilities were used to disable the OS system recovery component; - the system process lsass.exe launched the file or modified the file on disk; - executed obfuscated PowerShell script; - a call was made to the Windows API function; - Using the Rundll32 library, files from suspicious paths were launched. 24. The system according to claim 18, in which, when a sign of suspicious activity is found, an additional label is added from the database of suspicious activity to the security tool contained in the security notification, and when a computer attack is detected, it is additionally based on comparing the security tags with the security tool signatures of computer attacks from a database of targeted attacks. 25. The system of claim 18, wherein the information about the object further comprises, in particular, one of: - the checksum of the object or its part; - the source of the appearance of the object; - The results of the emulation of the execution of the object; - a log of calls to the API functions of the operating system from the side of the object; - the time of the appearance of the object within the computing device; - data transmitted over the network by the object. 26. The system of claim 18, wherein the detection tool searches the database of objects containing at least two computers for the virus signature from the threat database and, when the virus signature matches the records of the object database, defines the object as malicious and adds to the mentioned object in the object database a label indicating that the object is malicious. 27. The system of claim 26, wherein the detection means generates a security notification for the detected malicious object containing information about the object and information about the security features on which computers the object is contained. 28. The system according to p. 18, in which using security measures collect information about at least one of the following objects: - from the list of malicious objects; - if the object is not in the list of safe objects and in the list of malicious objects; - from the list generated by the administrator of the information system. 29. The system of claim 18, wherein additionally using a security measure, add a label to the object on the computer depending on the information about the object collected by the security tool and include the added label in the security notification. 30. The system of claim 29, wherein one of the following labels is added: - the verdict of the remedy; - starting a process from the list of suspicious launches; - the object is not in the list of safe objects and is not in the list of malicious objects; - remote launch of the object; - the object cleared the entries in the system log or OS security log; - information about the mismatch of the name of the object and its checksum; - tags associated with the object’s search results using external sources of computer attack intelligence; - the object is on computers on which files are classified that are classified as keyloggers, remote administration tools, monitoring tools, and are found on a small number of computers; - tasks of the scheduler or settings of autorun, or OS service, or driver, unique in the information system, that are not in the lists of allowed tasks; - violation of the authentication profile on the computer; - violations of the network activity profile of the process. 31. The system of claim 18, wherein the security measure is intended to collect information about objects on a computer for a predetermined period of time. 32. The system of claim 18, wherein information is collected about the following objects: a) from the list of malicious and suspicious objects; b) which are not in the list of safe objects and in the list of malicious and suspicious objects; c) from the list of objects formed by the administrator of the information system.

Images