Malicious Code Classification via Static and Dynamic Parameter Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The reliability of malicious code analysis is compromised when relying solely on either code static analysis or code dynamic analysis methods, as they fail to effectively classify similar malicious codes into groups.
Innovation Solution
Combining code static analysis and code dynamic analysis methods to obtain parameters associated with malicious code attributes and system execution, using comparison schemes to determine similarity and classify malicious codes into groups, with the aid of a network graph for visualizing relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If only code static analysis method is used, then analysis reliability is improved, but classification accuracy deteriorates
Solution Approach 1:
The patent combines code static analysis and code dynamic analysis methods into a unified classification system. The malicious code classification apparatus simultaneously performs both static analysis (examining code without execution) and dynamic analysis (monitoring execution behavior), then integrates the results from both methods to achieve reliable and accurate classification of malicious codes into families.
2Measurement precision
If only code dynamic analysis method is used, then classification accuracy is improved, but analysis reliability deteriorates
Solution Approach 1:
The patent merges code static analysis and code dynamic analysis methods to achieve both high classification accuracy and analysis reliability. The system performs static analysis to examine code structure and characteristics, and dynamic analysis to monitor execution behavior, then combines both results for robust malicious code classification that is both accurate and reliable.
3Measurement precision
If both code static analysis and code dynamic analysis methods are used, then classification accuracy is improved, but device complexity increases
Solution Approach 1:
The malicious code classification apparatus is designed as a universal system that can perform multiple analysis functions (static analysis, dynamic analysis, and classification) through integrated modules. The system uses a unified classification module that handles both static and dynamic analysis results, reducing overall system complexity despite performing multiple analysis functions.
Data Source
AI summary
An electronic device is disclosed. An electronic device according to various embodiments comprises: a processor; and a memory electrically connected to the processor, wherein the processor may be configured to: obtain a plurality of first parameters associated with attributes of at least one malicious code and a plurality of second parameters associated with a system in which the at least one malicious code is executed; obtain a similarity on the basis of a first comparison result according to a first comparison method between the plurality of first parameters and a second comparison result according to a second comparison method between the plurality of second parameters; and classify the at least one malicious code into at least one cluster on the basis of the similarity between the at least one malicious code. Other various embodiments may be provided.