| 摘要 |
PURPOSE: A method for detecting a file with an extension of a fraud name and an apparatus thereof are provided to compare an extension of a file with a real extension, thereby classifying a dangerous file with a malicious code to block if the extension is matched with the real extension. CONSTITUTION: A file header structure database(140) is composed of an extension and header information. A control module(150) extracts a display extension from a file name of a file and extracts header information corresponding to the display extension from the file header structure database. When the header information does not accord with contents of the file, the control module decides the extension of the file as a forged file extension. |
