USING STRING COMPARISON MALICIOUS CODE DETECTION AND CLASSIFICATION SYSTEM AND METHOD

摘要

PURPOSE: A system for detecting and classifying malicious codes based on string comparison scheme and a method for the system are provided to improve the performance of the system by refining strings. CONSTITUTION: A string extracting part(110) extracts strings from a malicious code binary file. A string refining part(120) refines elements which interrupt the detection/the classification of malicious codes from the extracted strings. The refined strings are compared to verify the similarity of one binary and another binary in a string comparing part(130). The strings are binary data continuously having string area data defined by American Standard Code for Information Interchange or Unicode standard.