SYSTEM AND METHOD FOR DETECTING MALICIOUS CODE BASED ON APPLICATION PROGRAMMING INTERFACE

摘要

A system for detecting malicious codes based on API includes: a malicious code management server storing first suspected malicious executable files extracted from traffic to be analyzed collected or inputted; and a virtualization analysis server executing the first suspected malicious executable files received from the malicious code management server, extracting first API call information called by malicious codes in user level and in kernel level, and transmitting the extracted first API call information to the malicious code management server.

主权项

1. A system for detecting malicious codes based on API, the system comprising:
a malicious code management server storing first suspected malicious executable files extracted from traffic to be analyzed collected or inputted; and a virtualization analysis server executing the first suspected malicious executable files received from the malicious code management server, extracting first API call information called by malicious codes in user level and in kernel level, and transmitting the extracted first API call information to the malicious code management server, wherein the malicious code management server has a malicious behavior analysis management module adapted to apply a previously set malicious code rule set to the first API call information received thereto to detect virtualized malicious behaviors.