Detecting unauthorized remote administration using dependency rules

A system for detecting a remote administration of a computer system, the system comprising:

• a hardware processor configured to:
• intercept a plurality of events occurring in the computer system including a first event and a second event associated with data transfer with an application executing in the computer system;
• determine that the first intercepted event is dependent on the second intercepted event based on parameters of the first intercepted event and the second intercepted event, wherein the parameters include a time elapsed between the interception of the first event and the interception of the second event and a pre-determined time threshold;
• generate a rule defining a dependency of at least one parameter of the first intercepted event on at least one parameter of the second intercepted event;
• responsive to determining a degree of similarity of the generated rule and a previously created rule exceeds a threshold value, identify at least one application as a remote administration application that created the first and second identified intercepted events;
• and
• block the identified remote administration application from exchanging data with the computer system.

A non-transitory computer readable medium comprising computer executable instructions for detecting a remote administration of a computer system, including instructions for:

• intercepting a plurality of events occurring in the computer system including a first event and a second event associated with data transfer with an application executing in the computer system;
• determining that the first intercepted event is dependent on the second intercepted event based on parameters of the first intercepted event and the second intercepted event, wherein the parameters include a time elapsed between the interception of the first event and the interception of the second event and a pre-determined time threshold;
• generating a rule defining a dependency of at least one parameter of the first intercepted event on at least one parameter of the second intercepted event;
• responsive to determining a degree of similarity of the generated rule and a previously created rule exceeds a threshold value, identifying at least one application as a remote administration application that created the first and second identified intercepted events;
• and
• blocking the identified remote administration application from exchanging data with the computer system.