KR101602881B1 - System ang method for detecting malignant code of analysis avoid type - Google Patents

Abstract

Disclosed is a malignant code detection system capable of accurately detecting a malignant code in a widows environment. According to the present invention, the malignant code detection system comprises: a virtualization analysis server to extract first API call information called by a malignant code at a user level by executing a first malignant doubt execution file through a virtualization agent, and first kernel action information at a kernel level; a malignant code management server to detect a first malignant code by applying the first API call information and the first kernel action information to a predetermined malignant code ruleset; and a real time analysis server to extract second API call information called by the malignant code at the user level by executing a second malignant doubt execution file wherein the first malignant code is not detected, and second kernel action information at the kernel level. Thus, the malignant code detection system can more accurately detect a malignant code than the existing one by detecting the malignant code and even an analysis avoidant malignant code from an execution file through a virtualization analysis and a real machine analysis.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a malicious code detection system,

The present invention relates to a malicious code detection system and method, and more particularly, to a malicious code detection system and method capable of accurately detecting malicious code in a Windows environment.

 The security product performance assessment agency checked the malware and found that more than 100 million new malicious code was detected by October 2014.

In order to respond quickly to such rapidly growing malicious codes, studies are being actively conducted to automate malicious code analysis.

Recently, a system for automatically analyzing malicious code behavior at the kernel level has been proposed.

However, since the existing malicious code detection system only monitored basic action events such as files, registers and processes, it was impossible to analyze the detailed behavior, and recently, malicious codes for analysis avoidance also appeared.

Korean Patent Publication No. 2011-0072113, publication date: June 29, 2011 Title of the invention: API calling method using API information DB and platform equipped with API information DB.

It is an object of the present invention to provide an analysis avoiding malicious code detection system and method for collecting an infected executable file in a Windows environment and detecting malicious code at a user level and / or a kernel level.

It is another object of the present invention to provide an analysis avoiding malicious code detection system and method for detecting an analysis evading malicious code from an infected execution file in a Windows environment.

According to an embodiment of the present invention, a malicious code management server for storing a first malicious suspicious execution file extracted from collected or input analysis target traffic; A first malicious executable file received from the malicious code management server is executed through the virtualization agent to extract first application program interface (API) call information called by the malicious code at the user level, A virtualization analysis server for extracting information and transmitting the information to the malicious code management server; And when the malicious code management server detects the first malicious code by applying the received first API call information and the first kernel malfunction code rule to the malicious code rules set in advance, 2 malicious suspicious execution file is received from the malicious code management server and executed through a real time agent, then second API call information called by the malicious code is extracted at the user level, and second kernel behavior information is extracted at the kernel level An analysis avoiding malicious code detection system including a real time analysis server is provided.

Here, the malicious code management server may collect the analysis target traffic from a network traffic sensor connected to the network.

In addition, the analysis target traffic may include the first malicious suspicious execution file and meta information.

Also, the virtualization analysis server may operate the at least one virtualization agent to extract the first API call information and the first kernel action information.

In addition, the virtualization analysis server may extract the first API call information through API hooking and transmit the first kernel behavior information together with the extracted first API call information to the malicious code management server.

Also, the malicious code management server may apply the malicious code ruleset including the hooking filtering to the received first API call information, and may apply the malicious code rule set to the first kernel malfunction information to detect a virtual malicious code have.

In addition, the real-time analysis server may operate the at least one real-time agent to extract the second API call information and the second kernel action information.

Also, the real-time analysis server may extract the second API call information through API hooking and transmit the second kernel behavior information together with the extracted second API call information to the malicious code management server.

In addition, the malicious code management server may apply the malicious code ruleset including the hooking filtering to the received second API call information, and apply the malicious code rule set to the second kernel malicious code information to detect an analysis malicious code .

The malicious code detection system may further include a vaccine diagnosis server that receives and analyzes the traffic to be analyzed from the malicious code management server, extracts the vaccine information, and transmits the extracted vaccine information to the malicious code management server Lt; / RTI >

Also, the vaccine diagnosis server may extract vaccine information for the first malicious suspicious execution file or the second malicious suspicious execution file using the URL information of the meta information included in the analysis target traffic.

In addition, the malicious code management server may analyze at least one of the vaccine information, the first and second API call information, and the first and second kernel behavior information, and may further detect the malicious malicious behavior can do.

According to another embodiment of the present invention, there is provided a malicious code management method comprising the steps of: (a) storing a collected or inputted executable file in a database of a malicious code management server; (b) extracting first API call information and kernel behavior information from the stored executable file in a virtualization environment from a virtualization analysis server and detecting a virtualization malicious code from a malicious code management server; And (c) extracting, from a real-time analysis server, second API call information and kernel behavior information in a real-time environment from the execution file in which the virtualization malicious code is not detected, and detecting a real-time malicious code in the malicious code management server A malicious code detection method of an analysis avoiding type is provided.

The malicious code detection method includes the steps of: (d) extracting vaccine information from the executable file in a vaccine diagnostic server, and executing the extracted information collectively, and then detecting an analysis avoiding malicious code in the malicious code management server The method comprising the steps of:

As described above, according to one embodiment, malicious code detection and analysis avoiding malicious codes can be detected from an executable file through virtualization analysis and real machine analysis, and more accurate malicious code (malicious behavior) detection can be achieved compared with the conventional method.

Moreover, these embodiments allow for more precise analysis avoiding malicious code detection through additional vaccine analysis.

1 is a diagram exemplarily showing an analysis evasion type malicious code detection system according to an embodiment of the present invention.
2 is a diagram illustrating a configuration of an analysis avoiding malicious code detection system according to an embodiment of the present invention in more detail.
3 is a diagram illustrating an example of traffic to be analyzed collected by the malicious code management server according to an embodiment of the present invention.
4 is a diagram illustrating an example of a fine-grave evasion type malicious code detection system according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

<Example of detection of malicious code of analysis avoiding type>

1 is a diagram exemplarily showing an analysis evasion type malicious code detection system according to an embodiment of the present invention.

1, an analysis avoiding malicious code detection system 100 according to an embodiment of the present invention includes a malicious code management server (hereinafter, referred to as &quot; malicious code &quot;) 100 for managing overall malicious code analysis including API analysis request, analysis assignment, A virtualization analysis server 120 for detecting a malicious code in a virtualization environment, and a real-time malicious code for detecting an analysis-evasive malicious code that is not detected by the virtualization analysis server 120, in response to an execution file of an application program executed in a Windows environment And an analysis server 130.

Hereinafter, each of the above configurations will be described. 2 is a diagram illustrating a configuration of an analysis avoiding malicious code detection system according to an embodiment of the present invention in more detail.

2, the analysis evasion type malicious code detection system 100 according to an embodiment of the present invention includes a malicious code management server 110, a virtualization analysis server 120, and a real time analysis A server 130, and the like.

First, the malicious code management server 110 manages overall malicious code analysis such as an API analysis request, execution file analysis allocation to be analyzed, and inquiry and storage of analysis results. To this end, the malicious code management server 110 collects the analysis target traffic from the network traffic sensor 101 as a malicious code analysis target.

At this time, the network traffic sensor 101 is connected to a network, for example, a wired or wireless network, collects traffic including an executable file of an application program executed in a system running in a Windows environment, extracts analysis target traffic requiring analysis, To the code management server (110). An example of the analysis target traffic requested for analysis can be shown in FIG.

Therefore, the malicious code management server 110 receives the traffic to be analyzed from the network traffic sensor 101, and uses the Rest API to store the first malicious suspicious execution file and various meta information of the application program included in the traffic to be analyzed And can be stored in the database 111. At this time, the executable file of the collected application program is preferably a PE (Portable Executable) file executable in a Windows environment.

However, it may be input, not collection. That is, the malicious code management server 110 may manually receive at least one executable file and store the executable file in the database 111. At this time, the input executable file is preferably a PE (Portable Executable) file executable in a Windows environment. However, it is needless to say that the present invention is not limited to the PE (Portable Executable) file described above.

The first malicious suspicious execution file stored in the database 111 is transmitted to the virtualization analysis server 120 to be described later.

In one embodiment, the virtualization analysis server 120 may simultaneously activate at least one virtualization agent 121 using virtualization techniques. At this time, the virtualization agent 121 driven in conjunction with the virtualization agent 121 may refer to a Windows system that is executed in a virtualized environment.

When the virtualization agent 121 is activated, the virtualization agent 121 can execute the first malicious suspicious execution file received from the malicious code management server 110. As a result of execution, first application program interface (API) call information called by the malicious code can be extracted on the user level.

Also, as a result of executing at least one virtualization agent 121, the first kernel behavior information can be extracted on the kernel level.

In other words, the virtualization analysis server 120 executes the first malicious suspicious execution file received from the malicious code management server 110 through the at least one virtualization agent 121, 1 API (Application Program Interface) call information, and extract the first kernel behavior information on the kernel level.

Furthermore, the virtualization analysis server 120 can extract the first API call information by monitoring the first API call information through API hooking on the user level. When the first API call information is extracted, the malicious behavior for the malicious code can be known.

In other words, 'Register at registry execution location', 'Copy file', 'Execute worm process', 'Create log file at C: W', 'Create mutex to prevent duplication' It is possible to know malicious behavior at the same user level and / or kernel level.

In this manner, the first kernel action information described above together with the extracted first API call information is transmitted to the malicious code management server 120. [

In this case, in this embodiment, the malicious code management server 110 stores the first API call information and the first kernel behavior information received from the virtualization analysis server 120 in the database 101, The first malicious code in the virtualization environment is detected by applying malicious code rule set in advance to the information and / or the first kernel malfunction code.

At this time, the malicious rule set may include hooking filtering. That is, the malicious code ruleset including the hooking filtering is applied to the first API call information, and the hooking-filtered first API calling information is compared with the predefined malicious code rule set, and if the identity is confirmed, the first malicious code of the virtualization environment is detected can do.

In addition, the malicious code management server 110 may compare the first kernel malfunction code with a predefined malicious code rule set, and may detect the first malicious code in the virtual environment when the identity is confirmed.

However, it can not detect all malicious codes from the first malicious suspicious execution file. The reason for this is that the first malicious suspicious execution file may include an analysis avoiding malicious code that is not detected because the virtualization agent 121 is activated.

Accordingly, in order to detect the analysis evasion type malicious code, the malicious code management server 110 can extract the second malicious suspicious execution file in which the first malicious code is not detected from the first malicious suspicious execution file.

The extracted second malicious suspicious execution file is transmitted to the real-time analysis server 130 to be described later. The transmitted second malicious suspicious execution file may be executed by at least one real time agent 131 corresponding to the real machine environment excluding the virtual environment.

That is, the real-time analysis server 130 executes the second malicious suspicious execution file received from the malicious code management server 110 through the real-time agent 131, and then transmits the second malicious code, (Application Program Interface) call information.

Preferably, the real-time analysis server 130 can extract the second API call information by monitoring API information called by the malicious code through API hooking at the user level. The extracted second API call information is transmitted to the real time analysis server 130.

In addition, the real-time analysis server 130 executes the second malicious suspicious execution file received from the malicious code management server 110 through the real-time agent 131, and then extracts the second kernel behavior information from the kernel level can do. The extracted second kernel behavior information is transmitted to the real-time analysis server 130 together with the second API call information described above.

Accordingly, in this embodiment, the malicious code management server 110 may further store the second API call information and / or the second kernel action information received from the real-time analysis server 130 in the database 111. [

Then, the malicious code management server 110 reapplies the preset malicious code ruleset to the stored second API call information to detect the second malicious code of the analysis type. At this time, the malicious code ruleset is applied in the same manner as described above, and a description thereof will be omitted.

Also, the malicious code management server 110 may reapply the previously set malicious code rule to the stored second kernel malicious code information to further detect the second malicious code of the analysis malicious type.

As described above, according to the present embodiment, the analysis avoiding malicious code is more accurately detected in the real-time agent environment of the execution file that can not detect the malicious code in the virtualization agent environment, thereby further reducing the damage caused by the malicious code.

However, there may be a need to detect more precise analysis evasion malware. This will be described with reference to FIG. 3 below.

&Lt; Precision analysis evasion type malicious code detection example >

4 is a diagram illustrating an example of a fine-grave evasion type malicious code detection system according to an embodiment of the present invention.

4, the malicious code detection system 100 according to an exemplary embodiment of the present invention includes a malicious code management server 110, a virtualization analysis server 120, An analysis server 130 and a vaccine diagnosis server 140. [

Since the malicious code management server 110, the virtualization analysis server 120, and the real-time analysis server 130 have been described above, the description thereof is omitted, but the same is applied to the present embodiment. Therefore, in the following, the vaccine diagnosis server 140 will be mainly described.

That is, in this embodiment, the vaccine diagnosis server 140 receives the analysis target traffic from the malicious code management server 110 using the vaccine diagnosis module 141, and executes the analysis target traffic. As a result of execution, vaccine information can be extracted.

Preferably, the URL information of the meta information contained in the traffic to be analyzed is executed to extract vaccine information for the first malicious suspicious execution file and / or the second malicious suspicious execution file.

At this time, the URL information may be the Referer URL information. Accordingly, the vaccine diagnostic server 140 can execute the Referer URL information to the vaccine diagnostic module 141 to extract the vaccine information for the first malicious suspicious execution file and / or the second malicious suspicious execution file. The extracted vaccine information is transmitted to the malicious code management server 110.

Accordingly, in the present embodiment, the malicious code management server 110 not only stores the first and second API call information, the first and second kernel behavior information that are stored in advance, but also at least the vaccine information provided from the vaccine diagnosis server 140 One or more of them are analyzed in an integrated manner to detect an analysis avoiding action.

At this time, it is desirable to detect the malicious behavior of the analysis avoiding type by applying the disabling technique for disabling the analysis evading malicious code to the integrated information. This makes it possible to further reduce the damage caused by malicious code by more precisely detecting the analysis avoiding malicious code that is not detected in the virtualized environment and / or the real machine environment.

<Example of detection method of malicious code of analysis avoiding type>

5 is a flowchart illustrating an exemplary method of detecting an analysis evasion type malicious code according to an embodiment of the present invention.

Referring to FIG. 5, an analysis avoiding malicious code detection method (S100) according to an embodiment of the present invention includes collecting and storing an execution file, extracting first API call information and kernel action Extracting the second API call information and the kernel action information from the executable file having the undetected malicious code in a real-time environment to extract a real-time malicious code (an analysis avoiding malicious code ) And extracting the vaccine information from the executable file, and integrating and executing the extracted information to detect a precise analysis evasion type malicious code in operation S140.

Here, in step S110, the malicious code analysis server 110 collects the analysis target traffic from the network traffic sensor 101 as a malicious code analysis target.

At this time, the network traffic sensor 101 is connected to a network, for example, a wired or wireless network, collects traffic including an executable file of an application program executed in a system running in a Windows environment, extracts analysis target traffic requiring analysis, To the code management server (110).

Thereafter, in step S110, the malicious code management server 110 receives the traffic to be analyzed from the network traffic sensor 101. Using the Rest API, the malicious suspicious execution file of the application program included in the analysis target traffic, The meta information can be stored in the database 111. [

At this time, the executable file of the collected application program is preferably a PE (Portable Executable) file executable in a Windows environment.

However, it may be input, not collection. That is, at step S110, at least one executable file may be manually input and stored in the database 111 of the malicious code management server 110. [

At this time, the input executable file is preferably a PE (Portable Executable) file executable in a Windows environment. However, it is needless to say that the present invention is not limited to the PE (Portable Executable) file described above. The first malicious suspicious execution file stored in the database 111 is transferred from the malicious code management server 110 to the virtualization analysis server 120.

In one embodiment, step S120 may simultaneously activate at least one virtualization agent 121 using virtualization technology. At this time, the virtualization agent 121 driven in conjunction with the virtualization agent 121 may refer to a Windows system that is executed in a virtualized environment.

When the virtualization agent 121 is activated, the virtualization agent 121 can execute the first malicious suspicious execution file received from the malicious code management server 110 in step S120. As a result of execution, first application program interface (API) call information called by the malicious code can be extracted on the user level.

As a result of executing at least one virtualization agent 121, the virtualization agent 121 can extract first kernel behavior information on the kernel level.

In other words, in step S120, the first malicious suspicious execution file received from the malicious code management server 110 is executed using at least one virtualization agent 121, and then the first API (called malicious code) Application Program Interface) call information from the virtualization analysis server 120 and extract first kernel behavior information on the kernel level.

Preferably, the first API call information is monitored by the virtualization analysis server 120 through API hooking on the user level, thereby extracting the first API call information.

In this manner, the first kernel action information described above together with the extracted first API call information is transmitted to the malicious code management server 120. [

In step S120, the first API call information and the first kernel behavior information received from the virtualization analysis server 120 are stored in the database 101 of the malicious code management server 110, The malicious code management server 110 detects the first malicious code in the virtualization environment by applying the malicious code rule set in advance to the API call information and / or the first kernel malfunction code.

At this time, the malicious rule set may include hooking filtering. That is, the malicious code ruleset including the hooking filtering is applied to the first API call information, and the hooking-filtered first API calling information is compared with the predefined malicious code rule set, and if the identity is confirmed, the first malicious code of the virtualization environment is detected can do.

In this embodiment, in step S120, the malicious code management server 110 may detect the first malicious code in the virtual environment when the first kernel malicious code rule is compared with the predefined malicious code rule set.

However, it can not detect all malicious codes from the first malicious suspicious execution file. The reason for this is that the first malicious suspicious execution file may include an analysis avoiding malicious code that is not detected because the virtualization agent 121 is activated.

Accordingly, in step S130, the malicious code management server 110 may extract the second malicious suspicious execution file in which the first malicious code is not detected, from the first malicious suspicious execution file in order to detect the analysis avoiding malicious code.

The extracted second malicious suspicious execution file is transmitted from the malicious code management server 110 to the real time analysis server 130. The transmitted second malicious suspicious execution file may be executed by at least one real time agent 131 corresponding to the real machine environment excluding the virtual environment.

That is, in step S130, the second malicious suspicious execution file received from the malicious code management server 110 is executed through the real-time agent 131, and then a second API (Application Program Interface) call information from the real-time analysis server 130.

Preferably, the second API call information can be extracted by monitoring API information called by the malicious code through API hooking at the user level. The extracted second API call information is transmitted from the real-time analysis server 130 to the real-time analysis server 130.

In this embodiment, step S130 is to execute the second malicious suspicious execution file received from the malicious code management server 110 through the real-time agent 131, and then send the second kernel behavior information in real time Can be further extracted from the analysis server 130. The extracted second kernel behavior information is transmitted to the real-time analysis server 130 together with the second API call information described above.

Accordingly, in this embodiment, the step S130 further stores the second API call information and / or the second kernel action information received from the real-time analysis server 130 in the database 111 of the malicious code management server 110 .

Preferably, the malicious code management server 110 reapplies a malicious code rule set previously set in the second API call information stored in the database 111 to detect a real-time analysis-type second malicious code. At this time, the malicious code ruleset is applied in the same manner as described above, and a description thereof will be omitted.

Furthermore, in step S130, the malicious code management server 110 may again apply the malicious code rule set previously stored in the stored second kernel malfunction information to further detect the second malicious code of the analysis malicious type.

As described above, according to the present embodiment, the analysis avoiding malicious code is more accurately detected in the real-time agent environment of the execution file that can not detect the malicious code in the virtualization agent environment, thereby further reducing the damage caused by the malicious code.

However, there may be a need to detect more precise analysis evasion malware. That is, in this embodiment, in step S140, the target traffic to be analyzed is provided from the malicious code management server 110 using the vaccine diagnosis module 141 and is executed by the vaccine diagnosis server 140. [ As a result of execution, vaccine information can be extracted.

Preferably, the URL information of the meta information contained in the traffic to be analyzed is executed to extract vaccine information for the first malicious suspicious execution file and / or the second malicious suspicious execution file.

At this time, the URL information may be the Referer URL information. Accordingly, in step S140, the referer URL information may be executed using the vaccine diagnostic module 141 to extract vaccine information for the first malicious suspicious execution file and / or the second malicious suspicious execution file. The extracted vaccine information is transmitted from the vaccine diagnosis server 140 to the malicious code management server 110.

Accordingly, in this embodiment, at step S140, at least one or more of the first and second API call information, the first and second kernel behavior information, and the vaccine information provided from the vaccine diagnosis server 140 are transmitted to the malicious code When the management server 110 integrally executes the program, the analysis avoiding action is detected.

At this time, it is desirable to detect the malicious behavior of the analysis avoiding type by applying the disabling technique for disabling the analysis evading malicious code to the integrated information. This will enable more precise detection of malicious code that is not detected in virtualized environments and / or real machine environments.

The embodiments described above may be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination.

The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention or may be those known and used by those skilled in the computer software arts.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the exemplary embodiments or constructions. You can understand that you can do it. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

100: Analysis avoiding malicious code detection system 101: Network traffic sensor
110: malicious code management server 111: database
120: Virtualization Analysis Server 121: Virtualization Agent
130: real time analysis server 131: real time agent
140: Vaccine diagnostic server

Claims (14)

A malicious code management server for storing a first malicious suspicious execution file extracted from collected or inputted analysis target traffic;
A first malicious executable file received from the malicious code management server is executed through the virtualization agent to extract first application program interface (API) call information called by the malicious code at the user level, A virtualization analysis server for extracting information and transmitting the information to the malicious code management server; And
When the malicious code management server detects the first malicious code by applying the received first API call information and the first kernel behavior information to the malicious code rules set in advance, The malicious suspicious execution file is received from the malicious code management server and executed through the real time agent. Then, the second API call information called by the malicious code is extracted at the user level, and the second kernel behavior information is extracted at the kernel level Real time analysis server;
An analysis avoiding malicious code detection system. The method according to claim 1,
The malicious code management server comprises:
An analysis avoiding malicious code detection system for collecting the traffic to be analyzed from a network traffic sensor connected to a network. 3. The method of claim 2,
The traffic to be analyzed,
And the first malicious suspicious execution file and the meta information. The method according to claim 1,
The virtualization analysis server includes:
Wherein the at least one virtualization agent is operated to extract the first API call information and the first kernel action information. 5. The method of claim 4,
The virtualization analysis server includes:
Extracting the first API call information through API hooking, and transmitting the first kernel behavior information together with the extracted first API call information to the malicious code management server. 6. The method of claim 5,
The malicious code management server comprises:
Applying the malicious code ruleset including hooking filtering to the received first API call information, and applying the malicious code ruleset to the first kernel behavior information to detect a virtual malicious code. The method according to claim 1,
The real-time analysis server includes:
Wherein the at least one real-time agent is operated to extract the second API call information and the second kernel action information. 8. The method of claim 7,
The real-time analysis server includes:
Extracting the second API call information through API hooking, and transmitting the second kernel action information together with the extracted second API call information to the malicious code management server. 9. The method of claim 8,
The malicious code management server comprises:
Applying the malicious code ruleset including the hooking filtering to the received second API call information, and applying the malicious code rule set to the second kernel behavior information to detect an analysis avoiding malicious code. The method according to claim 1,
A vaccination diagnostic server for receiving and analyzing the traffic to be analyzed from the malicious code management server to extract vaccine information and transmitting the extracted vaccine information to the malicious code management server;
The malicious code detection system comprising: 11. The method of claim 10,
The vaccine diagnosis server comprises:
And extracting vaccine information for the first malicious suspicious execution file or the second malicious suspicious execution file using URL information of the meta information included in the analysis target traffic. 11. The method of claim 10,
The malicious code management server comprises:
An analysis avoiding malicious code detection system for analyzing at least one of the vaccine information, the first and second API call information, and the first and second kernel behavior information and further detecting an analysis avoiding malicious activity by applying a disabling technique. (a) storing the collected or inputted executable file in the database of the malicious code management server;
(b) extracting first API call information and kernel behavior information from the stored executable file in a virtualization environment from a virtualization analysis server and detecting a virtualization malicious code from a malicious code management server; And
(c) extracting, from a real-time analysis server, second API call information and kernel behavior information in a real-time environment from the execution file in which the virtualization malicious code is not detected, and detecting a real-time malicious code in the malicious code management server;
The malicious code detection method comprising: 14. The method of claim 13,
(d) extracting the vaccine information from the executable file in the vaccine diagnostic server, integrating and executing the extracted information, and then detecting the analysis evading malicious code in the malicious code management server;
The malicious code detection method comprising:

Images