SYSTEM AND METHOD FOR DROPPER DISTINCTION

摘要

The present invention relates to a system and a method for discriminating a dropper. The system comprises a security management apparatus to obtain URL from a DNS query traffic heading to from an internal network to an external network, to obtain a matching ratio by comparing a hash value of the obtained URL with hash values stored in a hash table, to determine the URL as a malignant code distribution region when the obtained matching ratio is over the predetermined reference value and to transmit domain query information to an analysis server; and an analysis server to obtain a file of the URL based on domain query information transmitted from the security management apparatus, to perform a malignant code test for the obtained file, and to transmit a test result for infection to the security management apparatus.