System and method of detecting malicious computer systems

A system for detecting a malicious computer system, comprising:

• at least one hardware processor configured to:
• collect characteristics of a computer system, wherein the characteristics of the computer system are represented as points of a multidimensional space in which each dimension represents one characteristic of the computer system;
• determine relations between collected characteristics of the computer system;
• determine a time dependency of at least one state of the computer system based on determined relations, wherein the time dependency includes rules describing changes in values of the characteristics describing the at least one state of the computer system as a function of time;
• determine the at least one state of the computer system based at least on the determined time dependency and the changes in values of the characteristics, wherein the at least one state comprises nonstandard behaviors of the computer system, wherein the state of the computer system is represented as a closed surface in the multidimensional space encompassing a region of space whose points characterize a legal state of the computer system;
• and
• determine a degree of harmfulness of the computer system based on an analysis of the at least one state of the computer system in connection with one or more selected patterns representing a legal or malicious computer system, wherein the analysis comprises calculation of at least one scalar product of a first vector in the multidimensional space and a second vector from the one or more selected patterns, wherein the scalar product represents a degree of difference from the one or more selected patterns representing a legal or malicious computer system.

A non-transitory computer readable medium storing computer executable instruction for detecting a malicious computer system, including instructions for:

• collecting characteristics of a computer system, wherein the characteristics of the computer system are represented as points of a multidimensional space in which each dimension represents one characteristic of the computer system;
• determining relations between collected characteristics of the computer system;
• determining a time dependency of at least one state of the computer system based on determined relations, wherein the time dependency includes rules describing changes in values of the characteristics describing the at least one state of the computer system as a function of time;
• determining the at least one state of the computer system based at least on the time dependency and the changes in values of the characteristics, wherein the at least one state comprises nonstandard behaviors of the computer system, wherein the state of the computer system is represented as a closed surface in the multidimensional space encompassing a region of space whose points characterize a legal state of the computer system;
• and
• determining a degree of harmfulness of the computer system based on an analysis of the at least one state of the computer system in connection with one or more selected patterns representing a legal or malicious computer system, wherein the analysis comprises calculation of at least one scalar product of a first vector in the multidimensional space and a second vector from the one or more selected patterns, wherein the scalar product represents a degree of difference from the one or more selected patterns representing a legal or malicious computer system.