Discrimination of malicious changes to digital information using multiple signatures

摘要: The present system and method uses information about digital (objects) to determine whether or not changes the objects were caused by a normal operation malicious program. invention reference separation algorithm separate, at time, one more into plurality of subsets that describe object contents. A these are then selected selection associated with each subset is stored. At some later called test used separate signatures contents time. algorithm. develops respective subset. compared develop set differences. Rules applied differences time was changed (maliciously) from