APPARATUS AND METHOD FOR DETECTING MALICIOUS CODE

摘要

A malicious code detection method includes: registering information on an incoming TCP connection setup packet to an internal network and storing contents of a TCP data packet for the registered connection; storing data for the corresponding TCP connection upon a connection determined to request a traffic connection of the same feature as the incoming TCP traffic within a predetermined time during a TCP connection setup being directed to an external network; and determining a data packet to be malicious code upon a determination that the data packet of the outgoing TCP traffic is the same as the registered incoming TCP traffic data packet.