DETECTION OF HARMFUL SOFTWARE WITH CROSS-REVIEW

摘要

FIELD: computer safety.;SUBSTANCE: invention relates to computer security. Computing device for determining a suspicious executable object is disclosed, comprising a storage device and one or more hardware and/or software logic elements, comprising a cross-view detection mechanism configured to monitor the first operation, executed by the executable in the memory at the first level of abstraction; monitoring, in fact, simultaneous second operation performed by the executable object in the memory at the second level of abstraction, second level of abstraction differs from the first level of abstraction; determination that the first operation, in essence, causes a different computational result than the second operation, definition comprises converting the first operation and the second operation into a comparable format; and designating the executable object as suspicious.;EFFECT: technical result is a more reliable definition of a suspicious executable object that can be malicious software.;23 cl, 5 dwg