IMALICIOUS CODE DETECTION APPARATUS AND METHOD

摘要

Disclosed herein is a malicious code detection apparatus and method, which detect malicious code based on the states of a system before and after a malicious code sample is executed. A state of a sample execution system before a malicious code sample is executed. Static analysis and dynamic analysis of the malicious code sample are performed. After the malicious code sample has been executed, a state of the sample execution system is extracted, the results of extraction of the state are compared with results of extraction of the state of the sample execution system before the malicious code sample is executed, and change information of the system is acquired. It is detected whether malicious behavior of the malicious code sample has been conducted, using static analysis information and dynamic analysis information corresponding to results of performing static analysis and dynamic analysis and the system change information.

主权项

1. A malicious code detection method, comprising:
extracting a state of a sample execution system before a malicious code sample is executed; performing static analysis and dynamic analysis of the malicious code sample; after the malicious code sample has been executed, extracting a state of the sample execution system, comparing the results of extraction of the state with results of extraction of the state of the sample execution system before the malicious code sample is executed, and acquiring change information of the system; and detecting whether malicious behavior of the malicious code sample has been conducted, using static analysis information and dynamic analysis information corresponding to results of performing static analysis and dynamic analysis and the system change information.