KR101717941B1 - Method for malicious file diagnosis device and apparatus applied to the same - Google Patents
Method for malicious file diagnosis device and apparatus applied to the same Download PDFInfo
- Publication number
- KR101717941B1 KR101717941B1 KR1020150130900A KR20150130900A KR101717941B1 KR 101717941 B1 KR101717941 B1 KR 101717941B1 KR 1020150130900 A KR1020150130900 A KR 1020150130900A KR 20150130900 A KR20150130900 A KR 20150130900A KR 101717941 B1 KR101717941 B1 KR 101717941B1
- Authority
- KR
- South Korea
- Prior art keywords
- file
- diagnostic
- area
- buffer
- malicious code
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/563—Static detection by source code analysis
Abstract
The present invention relates to a malicious code diagnosis method and a device applied thereto. That is, the diagnosis value is extracted in the course of each file area in the diagnosis target file in the form of a data stream passing through the buffer, and the malicious code is diagnosed based on the extracted diagnosis value, It is possible to perform quick and efficient diagnosis of the malicious code included in the diagnosis target file by using only a minimum amount of resources. In addition, as the malicious code is diagnosed by searching the diagnosis rule in the existing file-based Anti-Virus engine referring to the diagnostic value extracted from the file area, the correspondence to the malicious code is unified and the reliable diagnosis result And can diagnose various strains, thereby ensuring a high diagnostic yield.
Description
The present invention relates to a method for quickly and efficiently diagnosing malicious code that can be included in a diagnostic file having a data stream form.
In a method of diagnosing a malicious code such as a virus or a worm, which may be included in a diagnostic object file in the form of an existing data stream, the entire file area of the diagnostic object file transmitted to the network is recorded in the same space as the hard disk A temporary file is created, and a diagnosis of the temporary file is performed using a file-based anti-virus engine.
However, this method has an advantage that the above-mentioned file-based anti-virus engine can be used as it is. However, since recording of the entire file area is required, it takes up a lot of disk space, (I / O) operation to the space may cause the performance of the equipment to deteriorate.
Another method for diagnosing malicious codes in the diagnostic target file in the form of a data stream may be a method of calculating a hash value of the entire file without generating a temporary file and diagnosing it.
However, this method has a merit that the diagnosis speed is fast because it does not generate the temporary file, but it can not diagnose the variant and can not utilize the existing file-based anti-virus engine.
As a result, a new method for diagnosing malicious code using an existing file-based anti-virus engine is required even when the entire file area of the diagnostic object file having the data stream form is not recorded.
It is an object of the present invention to provide a file-based anti-virus engine in which even if an entire file area of a diagnostic object file having a data stream form is not recorded, And to enable diagnosis of malicious code used.
According to a first aspect of the present invention, there is provided a malicious code diagnosis apparatus for diagnosing malicious code among a plurality of file areas in a diagnosis target file that passes through a buffer in the form of a data stream, A confirmation unit for checking whether a reserved area, which is a file area to be read for extraction, is input to the buffer; An extracting unit for extracting the diagnostic value by reading the file contents of the reserved area input to the buffer when it is confirmed that the reserved area is inputted; And a diagnosis unit for diagnosing whether or not the malicious code in the diagnostic object file is included based on the diagnostic value.
More specifically, the reserved area includes a basic reserved area, which is a file area defined in the header area of the diagnostic object file, and the extraction of the diagnostic value in the course of reading the file contents of the basic reserved area, And an additional reserved area that is a file area that is not input.
More specifically, when the header area of the file to be diagnosed is inputted to the buffer, the extracting unit reserves the file area defined in the header area as the basic reserved area, and reading the file contents of the basic reserved area When the extraction of the diagnostic value for a file area not inputted to the buffer is requested, the file area not inputted to the buffer is reserved as the additional reserved area.
More specifically, the reserved area is output from the buffer by a file area that is newly input into the buffer after a point of time when the reserved area is input to the buffer, and the extracting unit extracts the reservation And reading the file content of the area to extract the diagnostic value.
More specifically, when the extraction of the diagnostic value is not completed before being output from the buffer, the reserved area is stored in a cache separate from the buffer, and the extracting unit extracts the reserved area from the buffer And reading the file content of the reserved area stored in the cache to extract the diagnostic value.
More specifically, the diagnosis unit may include a diagnosis rule that refers to the specific diagnostic value extracted by the extraction unit, and when a plurality of other diagnostic values other than the specific diagnostic value are referred to together in the diagnostic rule, If it is determined that the extraction of the other diagnostic value is completed and that the specific diagnostic value and the plurality of other diagnostic values are consistent with the diagnostic information defined in the diagnostic rule, it is determined that the malicious code in the diagnostic target file is included Thereby diagnosing the disease.
According to a second aspect of the present invention, there is provided an operation method of a malicious code diagnosis apparatus, the malicious code diagnosis apparatus comprising: A checking step of checking whether a reserved area which is a file area to be read in order to extract a diagnostic value is input to the buffer; An extraction step of extracting the diagnostic value by reading the file contents of the reserved area input to the buffer when it is confirmed that the reserved area is input; And a diagnostic step of diagnosing whether or not the malicious code in the diagnostic object file is included based on the diagnostic value.
More specifically, the reserved area includes a basic reserved area, which is a file area defined in the header area of the diagnostic object file, and the extraction of the diagnostic value in the course of reading the file contents of the basic reserved area, And an additional reserved area that is a file area that is not input.
More specifically, in the extracting step, when a header area of the diagnosis target file is input to the buffer, the file area defined in the header area is reserved as the basic reserved area, and the file contents of the basic reserved area are read When the extraction of the diagnostic value for a file area not input to the buffer is requested, the file area not inputted to the buffer is reserved as the additional reserved area.
More specifically, the reserved area is output from the buffer by a file area that is newly input into the buffer after a point of time when the reserved area is input to the buffer, and the extracting step includes: And reading the file content of the reserved area to extract the diagnostic value.
More specifically, when the extraction of the diagnostic value is not completed before being output from the buffer, the reserved area is stored in a cache separate from the buffer, and the extracting step includes: And extracting the diagnostic value by reading the contents of the reserved area stored in the cache after the output.
More specifically, in the diagnosis step, there is a diagnosis rule referring to the specific diagnosis value extracted in the extraction step, and when a plurality of other diagnosis values other than the specific diagnosis value are referred together in the diagnosis rule, If it is determined that the diagnostic value of the diagnosis target file has been extracted and that the specific diagnostic value and the plurality of other diagnostic values are identical to the diagnostic information defined in the diagnostic rule, .
According to the malicious code diagnosis method and apparatus of the present invention, the diagnosis value is extracted in the process of each file area in the diagnosis target file in the form of a data stream passing through the buffer, and based on the extracted diagnosis value, By diagnosing the code, it is possible to perform quick and efficient diagnosis of the malicious code included in the diagnostic object file even when the entire contents of the diagnostic object file are not recorded.
In addition, as the malicious code is diagnosed by searching the diagnosis rule in the existing file-based Anti-Virus engine referring to the diagnostic value extracted from the file area, the correspondence to the malicious code is unified and the reliable diagnosis result And can diagnose various strains, thereby ensuring a high diagnostic yield.
FIG. 1 is an exemplary diagram illustrating a configuration of a diagnostic system including a malicious code diagnostic apparatus according to an embodiment of the present invention. Referring to FIG.
2 is an exemplary diagram illustrating a configuration of a malicious code diagnosis apparatus according to an embodiment of the present invention.
3 is an exemplary view showing a container-PE file to be diagnosed in the present invention.
4 is a flowchart illustrating an operation method of a malicious code diagnosis apparatus according to an embodiment of the present invention.
While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.
It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.
The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.
Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.
Hereinafter, an embodiment of the present invention will be described with reference to the accompanying drawings.
1 is a diagram illustrating an example of a diagnostic system according to an embodiment of the present invention.
1, the diagnostic system according to an embodiment of the present invention includes a client terminal 100 and a
Here, the malicious
The malicious
In an embodiment of the present invention, it is assumed that the malicious
In this regard, the client terminal 100 refers to a device for downloading a diagnostic object file in the form of a data stream from the
For example, the client terminal 100 may correspond to a network device such as an Intrusion Prevention System (IPS), or a personal device such as a PC, a notebook, a smart phone, a tablet PC, and a PDA. A device capable of downloading or uploading a diagnosis target file may be included.
Here, the file to be diagnosed refers to a file that can be transmitted and received in the form of a data stream. For example, moving image, image, text, and the like are applicable.
Meanwhile, according to an embodiment of the present invention, the malicious code
In order to diagnose malicious code in the diagnostic target file in the form of a data stream, as described in the prior art, it is necessary to create a temporary file by recording the entire file area of the diagnostic target file in the same space as the hard disk, Value must be calculated.
First, when a temporary file is generated, a temporary file is diagnosed using a file-based anti-virus engine. In this case, there is an advantage that a file-based anti-virus engine can be used as it is, As the recording of the whole file area is required, it takes up a lot of disk space. Further, there is a disadvantage that it may cause performance degradation due to file input / output (I / O) operation performed on the disk space in malicious code diagnosis .
When the hash value of the entire file is calculated, the diagnosis is made using only the calculated hash value. In this case, it is possible to diagnose the malicious code even if the entire file area of the diagnosis target file is not recorded While there are advantages, there is a disadvantage that the existing file-based anti-virus engine can not be used.
As a result, in a situation where malicious code is rapidly spreading, there is a growing need to prevent malicious codes transmitted through a network from a network device or a server in advance. However, due to the problems of the related art, It is a reality that high-specification equipments and a lot of resources are necessary to deal with all amounts.
Thus, according to an embodiment of the present invention, a method of diagnosing a malicious code using an existing file-based anti-virus engine even without recording the entire file area of a diagnostic object file having a data stream form is proposed Hereinafter, the configuration of the malicious code
2 is a diagram showing a schematic configuration of a malicious
2, the malicious
In addition, the malicious
In the
The size of the file area that can exist simultaneously in the
The entire configuration of the malicious
As a result, the malicious code
The
More specifically, the
In this case, when it is confirmed that the reserved area is input to the
Meanwhile, in order to confirm the reserved area input to the
Here, the reserved area is additionally required to extract the diagnostic value in the process of extracting the diagnostic value by reading the file contents of the basic reserved area and the basic reserved area, which are file areas defined in the header area of the diagnostic object file, Which is a file area that has not yet been input by the extracting
The
If a file area for which diagnostic value extraction is additionally required is identified in the process of extracting a diagnostic value from the file contents of the basic reservation area, the extracting
The reservation of the additional reserved area may be performed by the
That is, the extracting
When it is confirmed that the basic reservation area or the additional reservation area reserved by the extracting
The reservation and confirmation operation of the reservation area will be described with reference to FIG.
3 is a diagram for explaining a reservation and checking operation of a reserved area in the malicious
3 (S-1), when the header area in the diagnosis target file is input to the
The extracting
When the basic reservation area C1 is input to the
The
At this time, the
In this case, the extracting
The extracting
The extracting
At this time, the extracting
Here, the diagnostic value refers to various information having a similar or common value, for example, to variants of a specific malicious code or a general file, and being distinguished from other types of files.
On the other hand, in the case of the reserved area input to the
However, the reservation area is moved and stored in the
In this regard, the extracting
The extracting operation of the diagnostic value by the extracting
First, as shown in Fig. 3 (S-3), from the time when the basic reserved area C1 inputted to the
In this case, if the
When the additional reservation area C2 is input to the
The
The
More specifically, the
At this time, the
For example, if the diagnostic value extracted from the reserved area is '1234' calculated from the Import Table in the reserved area, and there is a specific diagnostic rule for diagnosing malicious code referring to the hash value of '1234' It can be diagnosed that malicious code is included in the diagnostic target file.
Here, the diagnosis rule retrieved by the
However, in the detected diagnosis rule, a plurality of diagnosis values are referenced together rather than a specific diagnosis value.
Accordingly, the
If some of the diagnostic values referenced in the retrieved diagnostic rule have not yet been extracted, diagnosis of the malicious code is suspended until the diagnostic value is extracted.
As described above, the malicious code
In addition, as the malicious code is diagnosed by searching the diagnosis rule in the existing file-based anti-virus engine that diagnoses malicious code by referring to the diagnostic value extracted from the reserved area, the response to the malicious code is unified And can provide a reliable diagnosis result, and it is possible to diagnose various variants, thereby ensuring a high diagnosis rate.
Hereinafter, the operation flow of the malicious
First, when it is confirmed that the header area in the diagnosis target file is input to the
When the notification is received from the
When it is confirmed that the reserved basic reservation area is input to the
The extracting
In operation S170, the extracting
In this case, the extracting
In this case, when it is confirmed that the additional reserved area is input to the
On the other hand, the extracting
Then, the
At this time, the
For example, if the diagnostic value extracted from the reserved area is '1234' calculated from the Import Table in the reserved area, and there is a specific diagnostic rule for diagnosing malicious code referring to the hash value of '1234' It can be diagnosed that malicious code is included in the diagnostic target file.
However, in the detected diagnosis rule, a plurality of diagnosis values are referenced together rather than a specific diagnosis value.
The
If some of the diagnostic values referenced in the retrieved diagnostic rule have not yet been extracted, diagnosis of the malicious code is suspended until the diagnostic value is extracted.
As described above, according to the operation flow of the malicious code
In addition, as the malicious code is diagnosed by searching the diagnosis rule in the existing file-based anti-virus engine that diagnoses malicious code by referring to the diagnostic value extracted from the reserved area, the response to the malicious code is unified And can provide a reliable diagnosis result, and it is possible to diagnose various variants, thereby ensuring a high diagnosis rate.
Meanwhile, the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, or may be embodied in a computer readable medium, in the form of a program instruction, which may be carried out through various computer means. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.
While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.
According to the malicious code diagnosis method and apparatus of the present invention, malicious code that can be included in a diagnostic object file having a data stream form can be diagnosed quickly and efficiently. It is not only the use of the related technology but also the possibility of commercialization or operation of the applied device, but it is an industrially applicable invention since it is practically possible to carry out clearly.
100: a client terminal
200: Server
300: Malicious code diagnostic device
Claims (13)
When it is confirmed that the reserved area is input to the buffer, the contents of the file of the reserved area input to the buffer are read and the diagnostic value is extracted before the reserved area is output from the buffer through the buffer An extraction unit; And
And a diagnosis unit for diagnosing whether or not a malicious code in the diagnostic object file is included based on the diagnostic value.
The reserved area includes:
Wherein the file is a file area defined in a header area of the diagnostic object file and an additional reservation area which is a file area that is additionally required to extract the diagnostic value in the process of reading the file contents of the basic reserved area, And a malicious code detection unit for detecting malicious code.
The extracting unit extracts,
Wherein when a header area of the file to be diagnosed is input to the buffer, the file area defined in the header area is reserved as the basic reserved area,
And reserving a file area not input to the buffer as the additional reserved area when extraction of the diagnostic value for a file area not inputted to the buffer is requested in reading the file contents of the basic reserved area. And the malicious code is diagnosed as malicious code.
The reserved area includes:
If extraction of the diagnostic value is not completed before being output from the buffer, the buffer is stored in a separate cache from the buffer,
The extracting unit extracts,
And reads the file content of the reserved area stored in the cache after the reserved area is output from the buffer to extract the diagnostic value.
Wherein the diagnosis unit comprises:
If there is a diagnostic rule that refers to the specific diagnostic value extracted by the extraction unit and a plurality of other diagnostic values other than the specific diagnostic value are referred together in the diagnostic rule,
If it is determined that the extraction of the plurality of other diagnostic values is completed and that both the specific diagnostic value and the plurality of other diagnostic values match the diagnostic information defined in the diagnostic rule, The malicious code diagnosis apparatus comprising:
When it is confirmed that the reserved area is input to the buffer, the contents of the file of the reserved area input to the buffer are read and the diagnostic value is extracted before the reserved area is output from the buffer through the buffer Extraction step; And
And diagnosing whether or not a malicious code is included in the diagnostic object file based on the diagnostic value.
The reserved area includes:
Wherein the file is a file area defined in a header area of the diagnostic object file and an additional reservation area which is a file area that is additionally required to extract the diagnostic value in the process of reading the file contents of the basic reserved area, Wherein the malicious code diagnosis apparatus comprises:
Wherein the extracting step comprises:
Wherein when a header area of the file to be diagnosed is input to the buffer, the file area defined in the header area is reserved as the basic reserved area,
And reserving a file area not input to the buffer as the additional reserved area when extraction of the diagnostic value for a file area not inputted to the buffer is requested in reading the file contents of the basic reserved area. Wherein the malicious code detecting device detects malicious code.
The reserved area includes:
If extraction of the diagnostic value is not completed before being output from the buffer, the buffer is stored in a separate cache from the buffer,
Wherein the extracting step comprises:
And reading the file content of the reserved area stored in the cache after the reserved area is output from the buffer to extract the diagnostic value.
The diagnostic step may comprise:
When there is a diagnostic rule referring to the specific diagnostic value extracted in the extraction step and a plurality of other diagnostic values other than the specific diagnostic value are referred to together in the diagnostic rule,
If it is determined that the extraction of the plurality of other diagnostic values is completed and that the specific diagnostic value and the plurality of other diagnostic values are identical to the diagnostic information defined in the diagnostic rule, The malicious code is diagnosed as having been diagnosed as having been diagnosed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| KR1020150130900A KR101717941B1 (en) | 2015-09-16 | 2015-09-16 | Method for malicious file diagnosis device and apparatus applied to the same |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| KR1020150130900A KR101717941B1 (en) | 2015-09-16 | 2015-09-16 | Method for malicious file diagnosis device and apparatus applied to the same |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| KR101717941B1 true KR101717941B1 (en) | 2017-03-20 |
Family
ID=58502646
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| KR1020150130900A KR101717941B1 (en) | 2015-09-16 | 2015-09-16 | Method for malicious file diagnosis device and apparatus applied to the same |
Country Status (1)
| Country | Link |
|---|---|
| KR (1) | KR101717941B1 (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4025882B2 (en) * | 2004-04-26 | 2007-12-26 | 国立大学法人岩手大学 | Computer virus specific information extraction apparatus, computer virus specific information extraction method, and computer virus specific information extraction program |
| US7802303B1 (en) * | 2006-06-30 | 2010-09-21 | Trend Micro Incorporated | Real-time in-line detection of malicious code in data streams |
| US8042184B1 (en) * | 2006-10-18 | 2011-10-18 | Kaspersky Lab, Zao | Rapid analysis of data stream for malware presence |
| KR20110134277A (en) * | 2010-06-07 | 2011-12-14 | 삼성에스디에스 주식회사 | Anti-malware system and method for action thereof |
-
2015
- 2015-09-16 KR KR1020150130900A patent/KR101717941B1/en active IP Right Grant
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP4025882B2 (en) * | 2004-04-26 | 2007-12-26 | 国立大学法人岩手大学 | Computer virus specific information extraction apparatus, computer virus specific information extraction method, and computer virus specific information extraction program |
| US7802303B1 (en) * | 2006-06-30 | 2010-09-21 | Trend Micro Incorporated | Real-time in-line detection of malicious code in data streams |
| US8042184B1 (en) * | 2006-10-18 | 2011-10-18 | Kaspersky Lab, Zao | Rapid analysis of data stream for malware presence |
| KR20110134277A (en) * | 2010-06-07 | 2011-12-14 | 삼성에스디에스 주식회사 | Anti-malware system and method for action thereof |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR101921052B1 (en) | Method and apparatus for identifying security vulnerability and cause point thereof of executable binaries | |
| US10133568B2 (en) | Embedding code anchors in software documentation | |
| US10121004B2 (en) | Apparatus and method for monitoring virtual machine based on hypervisor | |
| JP5265061B1 (en) | Malicious file inspection apparatus and method | |
| KR101228899B1 (en) | Method and Apparatus for categorizing and analyzing Malicious Code Using Vector Calculation | |
| US10467413B2 (en) | Method and apparatus of dynamic loading file extraction for an application running in an android container | |
| KR102317833B1 (en) | method for machine LEARNING of MALWARE DETECTING MODEL AND METHOD FOR detecting Malware USING THE SAME | |
| US20140365833A1 (en) | Capturing trace information using annotated trace output | |
| US9747385B2 (en) | Compression of cascading style sheet files | |
| KR101228902B1 (en) | Cloud Computing-Based System for Supporting Analysis of Malicious Code | |
| KR101327740B1 (en) | apparatus and method of collecting action pattern of malicious code | |
| CN109033818B (en) | Terminal, authentication method, and computer-readable storage medium | |
| US20200012780A1 (en) | Composite challenge task generation and deployment | |
| KR101717941B1 (en) | Method for malicious file diagnosis device and apparatus applied to the same | |
| EP3504597B1 (en) | Identification of deviant engineering modifications to programmable logic controllers | |
| CN110162729B (en) | Method and device for establishing browser fingerprint and identifying browser type | |
| US10242191B2 (en) | Dynamically-loaded code analysis device, dynamically-loaded code analysis method, and dynamically-loaded code analysis program | |
| CN109033426B (en) | Method and system for storing data operation information based on private block chain network | |
| KR102468431B1 (en) | Method and apparatus for disarming ole object in ms-ooxml | |
| US9473523B1 (en) | Execution of test inputs with applications in computer security assessment | |
| KR101775602B1 (en) | Detection method for injection, and apparatus applied to the same | |
| KR101645412B1 (en) | Malicious file diagnosis device and control method thereof | |
| KR101436496B1 (en) | System for remote diagnosis of malware | |
| KR102473436B1 (en) | Method and apparatus for managing of physical memory layout, computer-readable storage medium and computer program | |
| KR102218327B1 (en) | Recorded media recording of the bypass device, method and program for performing the analysis |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| E701 | Decision to grant or registration of patent right | ||
| GRNT | Written decision to grant |