Method for detecting malicious behavior by analyzing program code, and recording medium and device for performing same

Abstract

The present invention relates to a method by which a malicious behavior detection device for detecting malicious behavior by analyzing program code detects the malicious behavior. The method comprises the step of: generating a first control flow graph (CFG) by dynamically analyzing the program; generating a second CFG by extracting a code block which is likely to be executed by conditional branch instructions included in the program; and detecting a hidden code included in the program by comparing the first CFG and the second CFG, and detecting the malicious behavior of the program by determining whether the detected hidden code is malicious code. Accordingly, the hidden code related to the malicious behavior is extracted to detect the malicious behavior, and a new type.

Description

A method for detecting malicious behavior by analyzing program code, a recording medium and device for performing the method

[0001] The present invention relates to a method for detecting malicious behavior capable of responding to a new type of malicious code, and a recording medium and device for performing the same.

[0002] As the IoT market continues to grow, the number of IoT devices continues to increase annually. The growing importance of mobile devices in this environment is also driving rapid growth in the mobile application market. Consequently, the scale of mobile application malware is also increasing by the day.

[0003] According to some reports, the number of malicious applications increased from approximately 20 million in 2017 to approximately 36 million in 2019. Malicious applications continue to emerge at a rapid rate, averaging approximately 15 new ones per minute.

[0004] Therefore, there is a need to more precisely detect malicious mobile applications to protect users. Existing malware detection methods include static and dynamic analysis.

[0005] Malware detection methods using these static or dynamic analysis methods focus on utilizing the characteristics of the entire program or analyzing only the results of its execution.

[0006] Specifically, the static analysis method is a method of analyzing information that can be obtained without executing the program. For rapid malware detection, it mainly calculates the program's signature and compares it with the signature of already detected malware.

[0007] Meanwhile, the dynamic analysis method is a method that directly executes a program and analyzes the information that can be obtained during the execution process. It is a method that executes a program in a sandbox environment and analyzes the execution results to evaluate the presence or absence of malware and the impact of malware on the system.

[0008] A prime example of leveraging these analysis methods is endpoint services. These services monitor programs within the system for behavior similar to that of known malware, potentially targeting the system. They also utilize malware signatures for rapid malware detection.

[0009] However, while conventional static or dynamic analysis methods are effective in detecting well-known malware, they are limited in their ability to respond to new types of malware and require significant time to respond. This is confirmed by the time it takes for zero-day attacks to be discovered, as revealed in antivirus vendor analysis reports every year.

[0010] Therefore, a new method of detecting malicious activity is needed that can not only respond to new types of malware but also shorten the time required to respond.

[0011] [Prior Art Literature]

[0012] [Patent Document]

[0013] (Patent Document 1) Korean Patent Publication No. 10-1228899

[0014] The present invention has been devised to solve the above problems, and the purpose of the present invention is to provide a method for detecting malicious behavior by analyzing program code, which can detect malicious behavior by extracting hidden codes related to malicious behavior and thereby shortening the time required to discover and respond to new types of malicious code, and a recording medium and device for performing the same.

[0015] According to one embodiment of the present invention for achieving the above object, a method for detecting malicious behavior is provided, which is a method for detecting malicious behavior in a malicious behavior detection device that analyzes the code of a program to detect malicious behavior, comprising: a step of generating a first CFG (Control Flow Graph) by executing a dynamic analysis on the program; a step of extracting a code block that is likely to be executed by a conditional branch instruction included in the program to generate a second CFG; and a step of detecting a hidden code included in the program by comparing the first CFG and the second CFG, and determining whether the detected hidden code is a malicious code to detect the malicious behavior of the program.

[0016] And in the step of generating the second CFG, the second CFG can be generated while executing the program using a forced execution engine.

[0017] In addition, the step of generating the second CFG may include the step of setting the entry point of the program as the starting point of the forced execution engine; and the step of detecting whether the conditional branch instruction exists within the identified node while executing the program using the forced execution engine.

[0018] And in the step of detecting whether the conditional branch instruction exists, if the conditional branch instruction exists in the confirmed node, the target address of the conditional branch instruction is set to a root node, and the root node is repeatedly called to operate recursively, thereby extracting all nodes that are executable as the code block to generate the second CFG.

[0019] In addition, in the step of detecting whether the above conditional branch instruction exists, it is possible to prevent duplicate inspection by checking whether each of the confirmed nodes has a history of being inspected through a preset function.

[0020] And the above hidden code may be a code that exists in the second CFG but does not exist in the first CFG.

[0021] In addition, the step of detecting the malicious activity may include a step of analyzing the pattern of the hidden code to divide the hidden code into at least one or more pieces to create a divided CFG; a step of creating a signature for each of the divided CFGs; and a step of determining that the hidden code is a malicious code if the created signature exists in a database in which signatures of malicious codes are stored in advance.

[0022] Meanwhile, a recording medium according to one embodiment of the present invention for achieving the above purpose is a computer-readable recording medium having recorded thereon a computer program for performing a malicious activity detection method according to one embodiment of the present invention.

[0023] And, according to one embodiment of the present invention for achieving the above object, a malicious behavior detection device is a malicious behavior detection device that analyzes the code of a program to detect malicious behavior, and includes: an information extraction unit that performs dynamic analysis on the program to generate a first CFG (Control Flow Graph); a code execution unit that extracts a code block that is likely to be executed by a conditional branch instruction included in the program to generate a second CFG; and a hidden code analysis unit that compares the first CFG and the second CFG to detect hidden code included in the program, and determines whether the detected hidden code is malicious code to detect malicious behavior of the program.

[0024] Additionally, the code execution unit can generate the second CFG while executing the program using a forced execution engine.

[0025] And the code execution unit can set the entry point of the program as the starting point of the forced execution engine, and detect whether the conditional branch instruction exists within the confirmed node while executing the program using the forced execution engine.

[0026] In addition, the code execution unit, if the conditional branch instruction exists in the confirmed node, sets the target address of the conditional branch instruction to a root node, and repeatedly calls the root node to operate recursively, thereby extracting all nodes that are executable as the code block to generate the second CFG.

[0027] And the above code execution unit can prevent duplicate inspection by checking whether each of the confirmed nodes has a history of inspection through a preset function.

[0028] Additionally, the hidden code may be a code that exists in the second CFG but does not exist in the first CFG.

[0029] And the hidden code analysis unit includes a pattern analysis unit that analyzes the pattern of the hidden code and divides the hidden code into at least one or more to generate a divided CFG; and a signature generation unit that generates a signature for each of the divided CFGs, and the hidden code analysis unit can determine that the hidden code is a malicious code if the generated signature exists in a database in which signatures of malicious codes are stored in advance.

[0030] According to one aspect of the present invention described above, by providing a method for detecting malicious behavior by analyzing program code and a recording medium and device for performing the same, it is possible to detect malicious behavior by extracting hidden codes related to malicious behavior, thereby shortening the time required to discover and respond to new types of malicious code.

[0031] Figure 1 is a block diagram illustrating the configuration of a malicious behavior detection device according to one embodiment of the present invention.

[0032] FIG. 2 is a block diagram specifically explaining the process of detecting malicious behavior in a malicious behavior detection device according to one embodiment of the present invention.

[0033] FIG. 3 is a drawing for explaining a forced progress engine used in a code execution unit according to one embodiment of the present invention;

[0034] FIG. 4 is an exemplary diagram illustrating a process of detecting a hidden code in a hidden code analysis unit according to an embodiment of the present invention.

[0035] FIG. 5 is a block diagram illustrating the configuration of a hidden code analysis unit according to one embodiment of the present invention; and

[0036] Figure 6 is a flowchart illustrating a method for detecting malicious behavior according to one embodiment of the present invention.

[0037] The following detailed description of the present invention refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention, while different from each other, are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention. Furthermore, it should be understood that the positions or arrangements of individual components within each disclosed embodiment may be modified without departing from the spirit and scope of the present invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the present invention is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly described. Like reference numerals in the drawings designate the same or similar functionality throughout the several aspects.

[0038] The components according to the present invention are defined by functional distinctions rather than physical distinctions, and can be defined by the functions each component performs. Each component may be implemented as hardware or program code and processing units that perform each function, and the functions of two or more components may be implemented by including them in a single component. Therefore, the names given to the components in the following embodiments are not intended to physically distinguish each component, but rather to suggest the representative functions performed by each component, and it should be noted that the technical spirit of the present invention is not limited by the names of the components.

[0039] Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

[0040] FIG. 1 is a block diagram for explaining the configuration of a malicious behavior detection device (100) according to one embodiment of the present invention, and FIG. 2 is a block diagram for specifically explaining the process of detecting malicious behavior in a malicious behavior detection device (100) according to one embodiment of the present invention.

[0041] The malicious behavior detection device (100, hereinafter referred to as the device) according to this embodiment can quickly respond to new types of malicious code by analyzing the code of a program to find hidden code and analyzing whether the hidden code is related to malicious behavior.

[0042] To this end, the device (100) according to the present embodiment may include an information extraction unit (110), a code execution unit (110), and a hidden code analysis unit (150). In addition, the device (100) may be installed and executed with software (application) for performing a malicious behavior detection method, and the information extraction unit (110), the code execution unit (110), and the hidden code analysis unit (150) may be controlled by the software (application) for performing the malicious behavior detection method.

[0043] At this time, the device (100) may be a separate terminal or a module of a terminal. Furthermore, the information extraction unit (110), code execution unit (110), and hidden code analysis unit (150) may be formed as an integrated module or may be comprised of one or more modules. However, conversely, each component may be comprised of a separate module.

[0044] In addition, the device (100) may be mobile or fixed. This device (100) may be in the form of a server or an engine, and may be called by other terms such as a device, an apparatus, a terminal, a UE (user equipment), an MS (mobile station), a wireless device, a handheld device, etc. In addition, the device (100) may execute or produce various software based on an operating system (OS), that is, a system. Here, the operating system is a system program for enabling software to use the hardware of the device, and may include all mobile computer operating systems such as Android OS, iOS, Windows Mobile OS, Bada OS, Symbian OS, and Blackberry OS, as well as computer operating systems such as Windows series, Linux series, Unix series, MAC, AIX, and HP-UX.

[0045] And the device (100) may further include a storage unit in which a program for performing a malicious activity detection method is recorded, although not shown in the drawing. This storage unit temporarily or permanently stores data processed by the information extraction unit (110), the code execution unit (110), and the hidden code analysis unit (150), and may include a volatile storage medium or a non-volatile storage medium, but the scope of the present invention is not limited thereto.

[0046] First, the information extraction unit (110) according to the present embodiment executes dynamic analysis on the input program as illustrated in FIG. 2 to generate a first CFG (Control Flow Graph) (1CFG).

[0047] This information extraction unit (110) can generate the first CFG (1CFG) through the execution result for 'Normal Run Code' using a conventional dynamic analysis method.

[0048] Here, dynamic analysis methods can mean running a program in an environment similar to a typical malware analysis environment by utilizing a framework such as DBI (Dynamic Binary Instrumentation) or a CPU emulator.

[0049] And 'Normal Run Code' can mean code that is executed when the program execution flow is not manipulated and thus does not affect the execution result of the program when analyzing the program using dynamic analysis methods, etc.

[0050] In particular, the first CFG (1CFG) generated by the information extraction unit (110) according to this embodiment through this 'Normal Run Code' means a state in which there is no information about the hidden code (HC) that is executed only in a specific environment and under specific conditions.

[0051] And the information extraction unit (110) can transmit the generated first CFG (1CFG) to the hidden code analysis unit (150).

[0052] Meanwhile, the code execution unit (110) can extract a code block that is likely to be executed by a conditional branch instruction included in the program and generate a second CFG (2CFG).

[0053] To this end, the code execution unit (110) includes a forced execution engine (131), and FIG. 3 is a drawing for explaining the forced execution engine (131) used in the code execution unit (110) according to one embodiment of the present invention.

[0054] Exploring the conditional branch instructions of a program and finding all the code blocks that are executed based on the results of the conditional branch instructions means completely tracing and analyzing the execution path of the program.

[0055] Accordingly, the code execution unit (110) according to the present embodiment can use the forced execution engine (131) to find all paths that the program can reach and generate a second CFG (2CFG) including hidden code (HC) that operates only in specific environments and conditions.

[0056] To this end, the code execution unit (110) can initialize an environment for executing the program's code.

[0057] And the code execution unit (110) can set the program's entry point as the starting point of the forced execution engine (131).

[0058] Additionally, the code execution unit (110) can detect whether a conditional branch instruction exists within a node identified while executing a program using the forced execution engine (131).

[0059] At this time, the forced execution engine (131) can check all nodes of the graph according to the graph search algorithm while executing the program.

[0060] And, if a conditional branch instruction exists in the confirmed node, the code execution unit (110) sets the target address of the conditional branch instruction to the root node, and repeatedly calls the root node to operate recursively to extract all executable nodes as code blocks to generate a second CFG (2CFG).

[0061] Additionally, the code execution unit (110) can prevent duplicate inspection by checking whether each confirmed node has a history of inspection through a preset function.

[0062] Here, checking whether the node of the selected graph is a node that has already been visited by the code execution unit (110) may mean using the find_cond_branch function as illustrated in FIG. 3.

[0063] For example, assuming that a conditional branch instruction exists in the selected node and that the branched nodes in the graph are the right subnode and the left subnode, the following explanation can be given regarding the case where the code execution unit (110) repeatedly calls the root node to operate recursively.

[0064] First, if a conditional branch instruction exists in the selected node, the code execution unit (110) can set the target address of the conditional branch instruction to root_node as illustrated in Fig. 3. Then, the code execution unit (110) can first perform a check on the right lower node, for example.

[0065] After all verifications for the right subnodes are completed, the code execution unit (110) returns to the root_node and performs verification for the left subnodes, thereby discovering all conditional branch instructions and target addresses.

[0066] And the code execution unit (110) can generate a code block executed by a conditional branch instruction as data in the form of CFG.

[0067] Through the above process, the code execution unit (110) can generate a second CFG (2CFG) and transmit the generated second CFG (2CFG) to the hidden code analysis unit (150).

[0068] Meanwhile, the hidden code analysis unit (150) can receive the first CFG (1CFG) from the information extraction unit (110) and the second CFG (2CFG) from the code execution unit (110).

[0069] And the hidden code analysis unit (150) can detect the hidden code (HC) included in the program by comparing the first CFG (1CFG) and the second CFG (2CFG).

[0070] Additionally, the hidden code analysis unit (150) can detect malicious behavior of a program by determining whether the detected hidden code (HC) is malicious code.

[0071] FIG. 4 is an exemplary diagram illustrating a process of detecting a hidden code (HC) in a hidden code analysis unit (150) according to one embodiment of the present invention. As illustrated in FIG. 4, the hidden code analysis unit (150) can detect a hidden code (HC) included in a program by comparing a first CFG (1CFG) and a second CFG (2CFG). That is, among all code blocks included in the second CFG (2CFG), that is, nodes corresponding to the first CFG (1CFG), can be classified as visible codes (VC).

[0072] Here, visible code (VC) may mean normal code or code causing malicious behavior, but it is not a major part of the present invention as it is included in the first CFG (1CFG), that is, code that can be sufficiently confirmed through an existing dynamic analysis method, and thus a detailed description thereof will be omitted.

[0073] Meanwhile, the hidden code analysis unit (150) can classify a node that exists in the second CFG (2CFG) but does not exist in the first CFG (1CFG), i.e., a corresponding code block, as a hidden code (HC).

[0074] And Fig. 5 is a block diagram for explaining the configuration of a hidden code analysis unit (150) according to one embodiment of the present invention. As illustrated in Fig. 5, the hidden code analysis unit (150) may include a pattern analysis unit (151) and a signature generation unit (153).

[0075] The pattern analysis unit (151) is provided to analyze the pattern of the hidden code (HC) and divide the hidden code (HC) according to the analyzed pattern to generate a division CFG (3CFG).

[0076] Because hidden code (HC) consists of nodes containing many instructions starting from conditional branch instructions, the graph and the pattern of executed instructions must be analyzed to obtain the information necessary for malware detection.

[0077] Accordingly, the pattern analysis unit (151) analyzing the pattern of the hidden code (HC) may mean analyzing the hidden code (HC) to find a node having a conditional branch instruction, or in other words, a node to which a branch is made.

[0078] And, as shown in FIG. 5, the pattern analysis unit (151) can divide the hidden code (HC) to generate at least one divided CFG (3CFG), and can divide the hidden code (HC) based on the branching node to generate the divided CFG (3CFG).

[0079] In Fig. 5, for convenience of explanation, conditional branch instructions, i.e., branching nodes, are shown as being connected to each other by dotted lines, but two nodes connected by dotted lines mean the same branching node.

[0080] Additionally, the pattern analysis unit (151) can transmit the generated segmented CFG (3CFG) to the signature generation unit (153).

[0081] The signature generation unit (153) is provided to generate a signature for each split CFG (3CFG).

[0082] The signature generation unit (153) generates a signature for each split CFG (3CFG) as it is the same as calculating the signature of a program used in a static analysis method or can be sufficiently inferred from this, so a detailed description will be omitted.

[0083] When the signature for each split CFG (3CFG) is created through this process, the hidden code analysis unit (150) compares the created signature with a database in which the signature of the malicious code is stored in advance.

[0084] Accordingly, the hidden code analysis unit (150) can detect malicious behavior of the program by determining that the hidden code including the corresponding split CFG (3CFG) is malicious code if the generated signature exists in the database.

[0085] Through this, the device (100) according to the present embodiment can detect malicious behavior by extracting hidden codes related to malicious behavior, thereby shortening the time required to discover and respond to new types of malicious code.

[0086]

[0087] Meanwhile, FIG. 6 is a flowchart for explaining a malicious behavior detection method according to an embodiment of the present invention. Since the malicious behavior detection method according to an embodiment of the present invention is performed on a configuration substantially identical to that of the malicious behavior detection device (100) illustrated in FIG. 1, the same components as those of the malicious behavior detection device (100) illustrated in FIG. 1 are given the same drawing reference numerals, and repeated explanations are omitted.

[0088] The method for detecting malicious behavior according to the present embodiment includes a step of generating a first CFG (S110), a step of generating a second CFG (2CFG) (S130), and a step of detecting malicious behavior of a program by comparing the first CFG and the second CFG (S150).

[0089] In the step of generating the first CFG (S110), the information extraction unit (110) can perform dynamic analysis on the program to generate the first CFG (1CFG).

[0090] In the step of generating the second CFG (S130), the code execution unit (110) can extract a code block that is likely to be executed by a conditional branch instruction included in the program and generate the second CFG (2CFG).

[0091] In the step (S130) of generating the second CFG, the code execution unit (110) can generate the second CFG (2CFG) while executing the program using the forced execution engine (131).

[0092] And the step of generating the second CFG (S130) may include a step in which the code execution unit (110) sets the entry point of the program as the starting point of the forced execution engine (131).

[0093] Additionally, the step of generating the second CFG (S130) may include a step of detecting whether a conditional branch instruction exists within a node identified while the code execution unit (110) executes the program using the forced execution engine (131).

[0094] And in the step of detecting whether a conditional branch instruction exists, if a conditional branch instruction exists in the identified node, the target address of the conditional branch instruction is set to the root node, and the root node is repeatedly called to operate recursively, thereby extracting all executable nodes as code blocks to generate a second CFG (2CFG).

[0095] In addition, in the step of detecting whether a conditional branch instruction exists, the code execution unit (110) can prevent duplicate inspection by checking whether each identified node is a node that has a history of inspection through a preset function.

[0096] Meanwhile, in the step (S150) of detecting malicious behavior of a program by comparing the first CFG and the second CFG, the hidden code analysis unit (150) may include a step of detecting hidden code (HC) included in the program by comparing the first CFG (1CFG) and the second CFG (2CFG), and determining whether the detected hidden code (HC) is malicious code, thereby detecting malicious behavior of the program.

[0097] Here, the hidden code (HC) may mean a code that exists in the second CFG (2CFG) but does not exist in the first CFG (1CFG).

[0098] The step (S150) of detecting malicious behavior may include a step in which the hidden code analysis unit (150) analyzes the pattern of the hidden code (HC) and divides the hidden code (HC) into at least one or more pieces to generate a divided CFG (3CFG).

[0099] And the step of detecting malicious activity (S150) may include a step in which the hidden code analysis unit (150) generates a signature for each of the split CFGs (3CFG).

[0100] In addition, the step of detecting malicious behavior (S150) may include a step of determining that the hidden code (HC) is malicious code if a signature created by the hidden code analysis unit (150) exists in a database storing the signatures of malicious codes prepared in advance.

[0101] The malicious activity detection method of the present invention can be implemented in the form of program commands that can be executed by various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium can include program commands, data files, data structures, and the like, either singly or in combination.

[0102] The program commands recorded on the above computer-readable recording medium may be specially designed and configured for the present invention or may be known and available to those skilled in the art of computer software.

[0103] Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, and flash memory.

[0104] Examples of program instructions include not only machine language codes, such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

[0105] Although various embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and various modifications can be made by a person having ordinary skill in the art to which the present invention pertains without departing from the gist of the present invention as claimed in the claims, and such modifications should not be understood individually from the technical idea or prospect of the present invention.

[0106] [Explanation of symbols]

[0107] 100: Malicious Behavior Detection Device 110: Information Extraction Unit

[0108] 130: Code Execution Unit 131: Enforcement Engine

[0109] 150: Hidden Code Analysis Department 151: Pattern Analysis Department

[0110] 153: Signature generation unit

Claims

1. A method for detecting malicious behavior in a malicious behavior detection device that detects malicious behavior by analyzing the code of a program. A step of generating a first CFG (Control Flow Graph) by executing a dynamic analysis on the above program; A step of generating a second CFG by extracting a code block that is likely to be executed by a conditional branch instruction included in the above program; and A method for detecting malicious behavior, comprising the step of detecting a hidden code included in the program by comparing the first CFG and the second CFG, and determining whether the detected hidden code is malicious code, thereby detecting malicious behavior of the program.

2. In paragraph 1, In the step of generating the above second CFG, A method for detecting malicious behavior, wherein the second CFG is generated while executing the program using a forced execution engine.

3. In paragraph 2, The step of generating the above second CFG is: A step of setting the entry point of the above program as the starting point of the above enforcement engine; and A method for detecting malicious activity, comprising a step of detecting whether the conditional branch instruction exists within a node identified while executing the program using the above-mentioned enforcement engine.

4. In paragraph 3, In the step of detecting whether the above conditional branch instruction exists, A method for detecting malicious behavior, wherein if the conditional branch instruction exists within the confirmed node, the target address of the conditional branch instruction is set to a root node, and the root node is repeatedly called to operate recursively, thereby extracting all executable nodes as the code block and generating the second CFG.

5. In paragraph 4, In the step of detecting whether the above conditional branch instruction exists, A malicious behavior method that prevents duplicate inspection by checking whether each of the above-mentioned confirmed nodes has a history of inspection through a preset function.

6. In paragraph 1, The above hidden code is, A method for detecting malicious behavior, wherein the code exists in the second CFG but does not exist in the first CFG.

7. In paragraph 6, The steps for detecting the above malicious activity are: A step of analyzing the pattern of the hidden code and dividing the hidden code into at least one or more parts to generate a division CFG; generating a signature for each of the above split CFGs; and A method for detecting malicious behavior, comprising a step of determining that the hidden code is malicious code if the generated signature exists in a database storing previously prepared malicious code signatures.

8. A computer-readable recording medium having recorded thereon a computer program for performing the above-mentioned malicious activity detection method according to paragraph 1.

9. As a malicious activity detection device that analyzes the program code to detect malicious activity, An information extraction unit that generates a first CFG (Control Flow Graph) by executing dynamic analysis on the above program; A code execution unit that extracts a code block that is likely to be executed by a conditional branch instruction included in the above program and generates a second CFG; and A malicious behavior detection device comprising a hidden code analysis unit that detects hidden code included in the program by comparing the first CFG and the second CFG, and determines whether the detected hidden code is malicious code to detect malicious behavior of the program.

10. In paragraph 9, The above code execution part is, A malicious activity detection device that creates the second CFG while executing the program using a forced execution engine.

11. In paragraph 10, The above code execution part is, A malicious behavior detection device that sets the entry point of the above program as the starting point of the above enforcement engine, and detects whether the conditional branch instruction exists within the node confirmed while executing the above program using the above enforcement engine.

12. In paragraph 11, The above code execution part is, A malicious behavior detection device that, if the conditional branch instruction exists within the confirmed node, sets the target address of the conditional branch instruction to a root node, repeatedly calls the root node to operate recursively, extracts all executable nodes as the code block, and generates the second CFG.

13. In paragraph 12, The above code execution part is, A malicious activity detection device that prevents duplicate inspection by checking whether each of the above-mentioned confirmed nodes has a history of inspection through a preset function.

14. In paragraph 9, The above hidden code is, A malicious activity detection device, which is a code that exists in the second CFG but does not exist in the first CFG.

15. In paragraph 14, The above hidden code analysis unit, A pattern analysis unit that analyzes the pattern of the hidden code and divides the hidden code into at least one or more parts to generate a division CFG; and It includes a signature generation unit that generates a signature for each of the above-mentioned split CFGs, The above hidden code analysis unit, A malicious behavior detection device that determines that the hidden code is malicious code if the generated signature exists in a database storing previously prepared malicious code signatures.

Images