APPARATUS AND METHOD FOR DETECTING MALICIOUS CODE

摘要

The present invention relates to a device and a method for detecting a malicious code, based on the state of a system before and after executing a malicious code sample. The device comprises the steps of: extracting the state of a sample executing system before executing a malicious code sample; performing a static analysis and a dynamic analysis related to the malicious code sample; extracting the state of the sample executing system after executing the malicious code sample, and obtaining modified information of the system in comparison to the extracted result of the state of the sample executing system before and after executing the malicious code; and detecting a malicious behavior of the malicious code sample by using static analysis information and dynamic analysis information which are results of performing the static analysis and dynamic analysis, and the modified information of the system.