KR101880689B1 - Apparatus and method for detecting malicious code - Google Patents

Abstract

According to the present invention, in the malicious code diagnosis, the files are classified into suspicious malicious files and malicious malicious files based on the information on the files existing on the host, The process is run in a virtualized space isolated from the host's resources so that malicious code can be diagnosed more accurately while preventing damage to host resources by the execution of malicious behavior.

Description

[0001] APPARATUS AND METHOD FOR DETECTING MALICIOUS CODE [0002]

The present invention relates to an apparatus and a method for diagnosing malicious codes. More specifically, based on the information on the files existing on the host, the files are classified into suspicious files suspected of being malicious and normal files suspected of being malicious, And a device and a method for diagnosing whether the file or the process is malicious by being executed in a virtualization space.

Recently, due to the rapid development of internet technology and the spread of internet, harmful programs that threaten the security of user PCs have become more intelligent and diversified. Such a harmful program is a program that infiltrates into a user's PC to process an operation irrelevant to a user's intention or perform an abnormal function, and collects programs such as a virus, a worm, a Trojan horse, a backdoor and a spyware.

Such a harmful program may have various forms according to its type, but it may be a program that accesses another program or an operating system to change a code or extract information, an operation of transmitting or receiving an abnormal network packet, And the other is an abnormal behavior that is different from a general program such as concealment.

In the meantime, signature-based detection, behavior-based detection, and server-based detection methods have been proposed and used as methods for detecting malicious codes as described above.

In the dual signature-based detection method, the harmful program is detected or its execution is blocked on the basis of information on a harmful program of a known type (for example, pattern information on a specific part of the binary code).

However, such a signature-based detection method has a problem that it can hardly cope with a harmful program whose pattern is not registered or unknown.

In order to overcome such a problem, an action-based detection method has been proposed in which malicious programs are infected and blocked by monitoring various states occurring in the computing device without depending on the update detection policy of the security program, In the case of the behavior based detection, if the detection fails due to the execution of the process in the real environment, the resource of the actual environment is damaged.

In case of server-based virtual analysis, suspicious files must be transmitted to the server and wait until the analysis is completed. Therefore, it is difficult to accurately detect the server based on performance, usability, and network problems.

(Patent Literature)

Korean Registered Patent No. 10-1086203 (Registration date November 17, 2011)

Therefore, according to the present invention, the files are classified into suspicious files suspected to be malicious and normal files suspected to be malicious based on information on files existing on the host, And to provide an apparatus and method for diagnosing whether the file or the process is malicious by being executed in an isolated virtualization space.

According to another aspect of the present invention, there is provided a file management system including a file classifying unit for classifying a file as a suspicious file if the file is suspected to be malicious based on information about a file existing in the host, a file execution monitoring unit for monitoring whether there is an execution request for the suspicious file, A quarantine execution processor for quarantining suspicious processes to be executed by execution of the suspicious file in a virtualization space isolated from the resources of the host when the execution request is received; and a malicious activity monitoring unit for monitoring malicious actions performed by the suspicious process And a malignancy diagnosis unit for diagnosing the suspicious file or the suspicious process as a malicious code if the malicious action is performed.

In addition, the file classification unit classifies a file that is not suspected to be malicious among the files as a normal file, and the file execution monitoring unit monitors whether there is an execution request for the normal file, and the malicious- The method according to claim 1, further comprising a process management unit for checking whether an execution request for a file is caused by the suspicion process, wherein the quarantine execution processing unit, if the execution request for the normal file is caused by the suspicious process, In the virtualization space.

The information on the file may include at least one of history of the file generated, path of the file to the host, history of the file previously executed, history of modification of the file, or signature information of the file And a control unit.

The file classification unit may be configured to select the file as a suspicious file candidate if the path of the file to the host is a predetermined external inflow path and if the selected suspect file candidate is a file generated through a vulnerability of the web browser And classifying the selected suspicious file candidates into the suspicious file if the file is a script or a file created through a predetermined process of a predetermined program.

The file classification unit may be configured to select the file as a suspicious file candidate if the path of the file to the host is a preset external inflow path, And classifies the selected suspicious file candidates as suspicious files when the number of existing users who are not valid, the MS system file, or using the selected suspicious file candidates is less than a predetermined number.

The file classification unit may insert marking information indicating that the suspicious file is included in the meta area of the suspicious file, and the file execution monitoring unit may detect whether the marking information is included in the meta area of the suspected file, And recognizes an execution request for the suspicious file.

The predetermined external inflow path may be a path through which the file flows through the web browser, e-mail, a removable disk, or a predetermined program driven by the host.

According to another aspect of the present invention, there is provided a malicious code diagnosis method comprising the steps of: classifying a file as a suspicious file if the malicious file is suspected based on information about a file existing in the host; Inserting a suspicious process to be executed by execution of the suspect file in a virtualization space isolated from resources of the host when the execution request is received; monitoring whether malicious action is performed by the suspect process; And diagnosing the suspicious file or the suspicious process as a malicious code when the malicious action is performed.

The method of claim 1, further comprising: classifying a file that is not suspected to be malicious among the files as a normal file; monitoring whether an execution request is made for the normal file; determining whether an execution request for the normal file is caused by the suspicious process And isolating the process to be executed by execution of the normal file in the virtualization space if the execution request for the normal file is caused by the suspicious process.

The information on the file may include at least one of history of the file generated, path of the file to the host, history of the file previously executed, history of modification of the file, or signature information of the file And a control unit.

The classifying step may further include the steps of: selecting the file as a suspicious file candidate if the path of the file to the host is predetermined external inflow path; and selecting the suspect file candidate through a vulnerability of the web browser And classifying the selected suspicious file candidates into the suspicious file if the file is a file created through a predetermined process or a script of a predetermined program or a process.

The classifying step may further include the steps of: selecting the file as a suspicious file candidate if the path of the file to the host is a preset external inflow path; selecting the suspect file candidate as an unsigned file, Classifying the selected suspicious file candidates into a suspicious file when the number of existing users who use the selected suspicious file candidates is less than a predetermined number, .

The method may further include inserting marker information indicating the suspect file into the meta area of the suspicious file after the classifying step.

The predetermined external inflow path may be a path through which the file flows through the web browser, e-mail, a removable disk, or a predetermined program driven by the host.

According to the present invention, in the malicious code diagnosis, the files are classified into suspicious malicious files and malicious malicious files based on the information on the files existing on the host, The process has the advantage of being able to run malicious code in a virtualized space isolated from the host's resources, thereby allowing more accurate diagnosis of malicious code while preventing damage to host resources by execution of malicious actions.

In malicious code diagnosis, the files are classified into malicious suspicious files and malicious malicious normal files based on the information on the files existing on the host, So that the malicious code can be more accurately diagnosed and the damage of the host resource due to execution of the malicious code can be reduced.

According to the present invention, in the malicious code diagnosis, malicious code suspicious files are selected for files existing in the host, and behavior-based detection is performed through quarantine execution only for the selected suspicious files, The problem is minimized, and it is advantageous to enable efficient behavior-based malicious code diagnosis even on the host base.

In addition, there is an advantage that malicious behavior of a suspicious file can be detected more extensively by judging whether or not malicious code is executed through a quarantine execution process of a normal file process executed by a process of a suspicious file as well as a process of a suspicious file.

In addition, it can protect host resources even if it can not detect malicious behavior by executing the process of suspicious file in isolated space from host resource. Also, it can isolate malicious behavior It is advantageous to minimize the user inconvenience even if the malicious activity is detected incorrectly.

1 is a detailed block diagram of a malicious code diagnosis apparatus according to an embodiment of the present invention;
2 is a flowchart of an operation control process for diagnosing a malicious code in a malicious code diagnostic apparatus according to an embodiment of the present invention.

Hereinafter, the operation principle of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and these may be changed according to the intention of the user, the operator, or the like. Therefore, the definition should be based on the contents throughout this specification.

FIG. 1 shows a detailed block configuration of a malicious code diagnosis apparatus 100 according to an embodiment of the present invention. The file classification unit 102, the file execution monitoring unit 104, the process management unit 106, A malicious code monitoring unit 110, a malicious code diagnosis unit 112, and the like.

Hereinafter, the operation of each component of the malicious code diagnosis apparatus 100 according to the embodiment of the present invention will be described in detail with reference to FIG.

First, the file classification unit 102 analyzes each file based on information about a file existing on the host to check whether the file is a normal file or a malicious file. If the file is suspected to be malicious, the file classification unit 102 classifies the file as a suspicious file. At this time, the information about the file may include a history of creation of the file, an external inflow path of the file to the host, history of the file executed before, history of the file modified, or signature information of the file.

That is, when setting the suspicious file, the file classifying unit 102 classifies the suspicious file into the history of creation of the file on the host, the external inflow path of the file to the host, the history of the previous execution of the file, The history of the malicious code or the signature information of the file to check whether the malicious code is a suspicious file.

In addition, the file classifying unit 102 may classify a predetermined external object including a Web browser, an e-mail, an excel, an office program, a vulnerability, a usable disk, And monitors whether or not any file is generated on the host computer through the funnel. When a host file is created, it is checked whether the malicious code is a suspicious file by using a file signature, overall file information, and cloud DB information. If the malicious code is suspected, have.

At this time, if the external inflow path to which the file is inputted into the host is a preset external inflow path, for example, the file classifying unit 102 selects the file as a suspect file candidate, checks the generation history of the selected file, If the file is created through a vulnerability of the web browser or a file created through a script or process of a predetermined program, the file may be set as a suspicious file, but the present invention is not limited thereto.

At this time, the vulnerability of the web browser may be, for example, an advertisement page on a web browser, etc., and a file created on the host without knowing the user through clicking on the advertisement page may be a file created through the vulnerability of the web browser Lt; / RTI > The specific program may be, for example, a program such as an Excel or an office. Since programs such as Excel and Office generally do not generate an executable file, programs such as Excel and Office are executed on the host When a file is generated through a script or a process, the file can be set as a suspicious file.

The file classifying unit 102 may classify the file as a suspicious file candidate and check static information of the selected file if the external inflow path into which the file has entered the host is a predetermined external inflow path If the file is an unsigned file, the signature verification certificate is invalid, or the file is an MS system file, or the number of existing users using that file is less than a predetermined number, the file can be set as suspicious file , But is not limited thereto.

The static information may be information that can be verified by extracting information included in a header or the like of a file without executing the file. For example, the static information may include information such as whether the file is signed, Information of the signature verification certificate, file property information such as whether the file is an MS system file, and the like, but the present invention is not limited thereto. At this time, it is necessary to set the suspicious file as a file whose signature is falsified, the signature verification certificate is invalid, or the signer information is inconsistent as a result of checking the above static information. In addition, when it is determined that the file has been used by a large number of users for a long time by referring to the cloud DB information storing information on various files, it is not necessary to set the file as a suspicious file. However, It is necessary to set it as a suspicious file if the number of users using the file is less than a predetermined number and the file has not been commonly used by many users.

In addition, the file classification unit 102 inserts marker information indicating that the suspicious file is a suspicious file on a meta area (ADS: Alternate Data Stream) of the suspect file, so that the file execution monitoring unit 104 suspends It is possible to recognize whether or not the file is executed. In this case, such mark information may include information such that the corresponding file is a suspicious file, information on the inflow path of the corresponding file, creation time, etc. The mark information may be recorded in the meta information of the file, So that the host computer can be continuously monitored at the time of rebooting without being lost even if the power of the host computer is turned off.

The file execution monitoring unit 104 monitors whether there is an execution request for an arbitrary file existing in the host. If there is an execution request for an arbitrary file, the file execution monitoring unit 104 determines whether the execution requested file is an execution request for a normal file Checks whether the file is an execution request.

When there is an execution request for the suspicious file, the file execution monitoring unit 104 notifies the execution request of the suspicious file to the isolation execution processing unit 108, and the process of the suspicious file is executed by the isolation execution processing unit 108, And so on. If there is an execution request in the normal file, the file execution monitoring unit 104 informs the isolation execution processing unit 108 of the execution request of the normal file if the normal file is requested to be executed by the process of the suspicious file The process of the normal file can be executed by the isolation execution processing unit 108 in a space isolated from a host resource such as a virtualization space.

The process management unit 106 is connected to the isolation execution processing unit 108 to detect a suspicious process of a quarantine file that has been quarantined in a space isolated from a host resource such as a virtualization space, It is managed as a group with the derived process to be executed.

For example, even if the file is classified as a normal file by the file classifying unit 102, the file may be called and executed by the suspicious process of the suspicious file. Accordingly, the process management unit 106 manages the suspicious process and the derived process together as a group, thereby checking whether the execution request for the normal file is caused by the suspicious process of the suspicious file.

When there is an execution request for a suspicious file classified as a suspicious file, the isolation execution processing unit 108 quarantines suspicious processes to be executed by execution of a suspicious file in a virtualization space isolated from a host resource. If there is an execution request for the normal file, the isolation execution processing unit 108 checks whether or not the execution request for the normal file is caused by the suspicious process. If the execution request is caused by the suspicious process, The derived process derived from the process to be executed by the execution of the suspicious process, namely, the isolation process in the virtualization space.

In other words, the isolation execution processing unit 108 isolates suspicious processes from the host resources such as the virtualization space, thereby protecting the resources of the host environment by preventing suspicious processes from harming the host environment do. At this time, the isolation execution processing unit 108 can isolate and execute the derived process derived from the suspicious file process and executed when the suspicious file is requested to be executed in the isolation space.

The malicious behavior monitoring unit 110 monitors whether a malicious action occurs due to a suspicious process during isolation execution of a suspicious process in conjunction with the isolation execution processing unit 108. [

The malicious code diagnosis unit 112 receives a malicious action performed by the suspicious process executed by the malicious action monitoring unit 110 and determines whether the malicious action is a malicious code through behavior based analysis or the like, If it is judged as a code, the suspicious file or suspicious process is diagnosed as malicious code. In addition, the malicious code can be processed by blocking or deleting the suspicious file or the suspicious process for the suspect file or suspicious process diagnosed by the malicious code. In addition, for a file diagnosed with a malicious code, information about the file can be registered and managed as malicious code information.

In the embodiment of the present invention, the above malicious code diagnosis unit 112 is provided in the host. However, the malicious code diagnosis unit 112 may include an external malicious code diagnosis server 112 connected to the host and a network, (Not shown).

In this case, the malicious code diagnosis server may be a server connected to the host and the network to diagnose the malicious code and return the diagnosis result. If malicious code is received from the host, the malicious code included in the cloud DB information The malicious code for malicious code can be diagnosed using the signature information and behavior-based analysis information, and the diagnosis result can be returned to the host.

FIG. 2 illustrates an operation control flow for classifying a suspicious file on a host and diagnosing a malicious code in the malicious code diagnostic apparatus 100 according to an embodiment of the present invention. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 and 2. FIG.

First, the malicious code diagnostic apparatus 100 classifies the file as a suspicious file if the file is suspected to be malicious, and classifies it as a normal file if it is not suspected to be malicious based on information about a file existing in the host (S200). At this time, the information about the file may include a history of creation of the file, an external inflow path of the file to the host, history of the file executed before, history of the file modified, or signature information of the file.

At this time, in setting the suspicious file, the malicious code diagnostic apparatus 100 may set a suspicious file on the basis of a history of generation of the file, an external inflow path of the file to the host, a history of the previous execution of the file, The modified history or the signature information of the file to check whether the malicious code is a suspicious file.

That is, for example, the malicious code diagnosis apparatus 100 includes a web browser, an e-mail, an excel, an office program, a vulnerability, a removable disk (usb) And monitors whether or not an arbitrary file is generated on the host computer through the predetermined supervised external inflow path. When a host file is created, it is checked whether the malicious code is a suspicious file by using a file signature, overall file information, and cloud DB information. If the malicious code is suspected, have.

If the malicious code diagnosis apparatus 100 detects the malicious code as a suspicious file candidate, for example, if the external inflow path into which the file is inputted into the host is a preset external inflow path, the malicious code diagnostic apparatus 100 checks the generation history of the selected file, If the file is a file created through a vulnerability in a web browser, or a file created through a script or process of a predetermined program, the file can be set as a suspicious file.

If the malicious code diagnosis apparatus 100 detects malicious file candidates, for example, if the external inflow path to which the file is inputted into the host is a predefined external inflow path, the malicious code diagnostic apparatus 100 may check static information of the selected file If the file is an unsigned file, the signed certificate is invalid, or the file is an MS system file, or the number of existing users using that file is less than a predetermined number, the file can be set as a suspect file. have.

Then, the malicious code diagnosis apparatus 100 monitors whether there is an execution request for an arbitrary file existing in the host (S202).

At this time, if there is an execution request for an arbitrary file, the malicious code diagnostic apparatus 100 checks whether the execution requested file is an execution request for a normal file or an execution request for a suspicious file (S204).

At this time, if the file requested to be executed is a suspicious file, the malicious code diagnosis apparatus 100 isolates the suspicious process to be executed by executing the suspicious file in a virtualization space isolated from the host resource (S206). That is, the malicious code diagnosis apparatus 100 protects the resources of the host environment by suspending suspicious processes in a hosted resource such as a virtualized space, thereby preventing suspicious processes from harming the host environment .

Then, the malicious code diagnostic apparatus 100 monitors whether or not a malicious action is aquired by the suspicious process during the isolation execution of the suspicious process (S208). If the malicious code is inspected by the suspicious process, Based analysis, etc., and if the malicious code is determined, the suspicious file or the suspicious process is diagnosed as a malicious code. In addition, the suspicious file or suspicious process diagnosed by malicious code can be processed (S214) by blocking or deleting execution of the suspicious file or suspicious process.

Meanwhile, when the malicious code diagnosis apparatus 100 checks whether the file requested to be executed is an execution request for a normal file or an execution request for a suspicious file (S204), if the file requested to be executed is a normal file It is checked whether an execution request for the normal file is generated by the suspicious process (S210).

At this time, if the execution request for the normal file is not generated by the suspicious process, the malicious code diagnostic apparatus 100 normally executes the process of the normal file requested to be executed by the host (S212).

However, if the execution request for the normal file is generated by the suspicious process, the malicious code diagnostic apparatus 100 sets the suspicious process to the process to be executed by execution of the normal file, that is, the derived process derived from the suspicious process Execute quarantine in isolated virtualization space with resources of the host (S206).

Then, the malicious code diagnosis apparatus 100 monitors whether a malicious action occurs due to a suspicious process during the isolation execution of the suspicious process (S208), in the same manner as the malicious behavior check and diagnosis / , When the malicious action is detected to be performed by the suspicious process, the malicious code is judged as malicious code through behavior-based analysis or the like, and if the malicious code is judged, the suspicious file or the suspicious process is diagnosed as malicious code do. In addition, the suspicious file or suspicious process diagnosed by the malicious code can be processed (S214) by blocking or deleting the suspicious file or suspicious process.

As described above, according to the present invention, in the malicious code diagnosis, the files are classified into suspicious malicious files and malicious malicious files based on the information on the files existing in the host, The process according to the execution of the file is executed in a virtualization space isolated from the host resource, thereby making it possible to diagnose the malicious code more accurately while preventing the damage of the host resource due to execution of malicious action.

According to the present invention, in the malicious code diagnosis through the host-based behavior analysis, malicious code suspicious files that require isolation execution based on the inflow path, generation history, and static information of each file are selected for the files generated by the host By performing behavior-based detection only for selected suspicious files, performance degradation and compatibility problems are minimized, enabling efficient behavior-based malicious code diagnosis even on the host-based basis, and the process associated with suspicious files and suspicious files It is possible to protect host resources even if malicious activity can not be detected by judging whether malicious code is detected through quarantine execution.

Combinations of the steps of each flowchart attached to the present invention may be performed by computer program instructions. These computer program instructions may be loaded into a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus so that the instructions, which are executed via a processor of a computer or other programmable data processing apparatus, Lt; / RTI > These computer program instructions may also be stored in a computer usable or computer readable memory capable of directing a computer or other programmable data processing apparatus to implement the functionality in a particular manner so that the computer usable or computer readable memory It is also possible to produce manufacturing items that contain instruction means for performing the functions described in each step of the flowchart. Computer program instructions may also be stored on a computer or other programmable data processing equipment so that a series of operating steps may be performed on a computer or other programmable data processing equipment to create a computer- It is also possible for the instructions to perform the processing equipment to provide steps for executing the functions described in each step of the flowchart.

In addition, each step may represent a module, segment, or portion of code that includes one or more executable instructions for executing the specified logical function (s). It should also be noted that in some alternative embodiments, the functions mentioned in the steps may occur out of order. For example, the two steps shown in succession may in fact be performed substantially concurrently, or the steps may sometimes be performed in reverse order according to the corresponding function.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Accordingly, the scope of the invention should not be limited by the described embodiments but should be defined by the appended claims.

100: malicious code diagnosis apparatus 102: file classification unit
104: file execution monitoring unit 106: process management unit
108: isolation execution processing unit 110: malicious activity monitoring unit
112: malicious code diagnosis unit

Claims (14)

A file classifying unit for classifying the file into a suspicious file if the file is suspected to be malicious based on information about the file present in the host,
A file execution monitoring unit for monitoring whether there is an execution request for the suspicious file;
A quarantine execution processor for isolating suspicious processes to be executed by execution of the suspicious file in a virtualization space isolated from resources of the host,
A malicious behavior monitoring unit monitoring whether a malicious action is performed by the suspicion process;
And a malicious diagnosis unit for diagnosing the suspicious file or the suspicious process as a malicious code if the malicious action is performed,
The file classification unit may include:
If the path of the file to the host is a preset external inflow path, the file is selected as a suspicious file candidate, and the selected suspect file candidate is a file generated through a vulnerability of the web browser, Or if the selected suspect file candidate is an unsigned file, the signature verification certificate is an invalid file, an MS system file, or an existing user who uses the selected suspect file candidate If the number is less than or equal to a predetermined number, classifies the selected suspicious file candidates into the suspect file
Malicious code diagnostic device.
The method according to claim 1,
The file classification unit classifies a file that is not suspected to be malicious among the files as a normal file, and the file execution monitoring unit monitors whether there is an execution request for the normal file,
The malicious code diagnosis apparatus,
Further comprising a process management unit for checking whether an execution request for the normal file is caused by the suspicious process,
Wherein the isolation execution processing unit
If the execution request for the normal file is caused by the suspicion process, executing a process to be executed by execution of the normal file in the virtualization space
Malicious code diagnostic device.
The method according to claim 1,
The information on the file is,
A history of the file generated, a path of the file to the host, a history of the file previously executed, a history of modification of the file, or signature information of the file
Malicious code diagnostic device.
delete delete The method according to claim 1,
The file classification unit may include:
Inserting marker information indicating the suspect file into a meta area of the suspicious file,
The file execution monitoring unit,
Recognizing an execution request for the suspicious file based on whether the mark information is inserted in the meta area of the suspicious file
Malicious code diagnostic device.
The method according to claim 1,
Wherein the predetermined external inflow path includes:
A path through which the file is transferred to the host via a web browser, an e-mail, or a removable disk, or a path through which a predetermined program is run on the host
Malicious code diagnostic device.
Classifying the file into a suspicious file if the file is suspected to be malicious based on information on the file existing on the host;
Monitoring whether there is an execution request for the suspicious file;
Executing a suspicious process to be executed by execution of the suspicious file in a virtualized space isolated from resources of the host when the execution request is received;
Monitoring whether a malicious action is performed by the suspicion process;
And diagnosing the suspicious file or the suspect process as a malicious code if the malicious action is performed,
Wherein said classifying comprises:
Selecting the file as a suspicious file candidate if the path of the file to the host is a preset external inflow path,
Classifying the selected suspicious file candidate into the suspicious file if the selected suspicious file candidate is a file generated through a vulnerability of the web browser or a file created through a script or process of a predetermined program;
If the selected suspicious file candidate is an unsigned file, a signature verification certificate is invalid file, an MS system file, or the number of existing users using the selected suspicious file candidate is equal to or less than a preset number, Step to classify suspect file candidates into suspicious files
A malicious code diagnosis method.
9. The method of claim 8,
Classifying a file that is not suspected to be malicious among the files as a normal file;
Monitoring whether there is an execution request for the normal file;
Checking whether the execution request for the normal file is due to the suspicion process,
If the execution request for the normal file is due to the suspicion process, executing the process to be executed by execution of the normal file in the virtualization space
The method comprising the steps of:
9. The method of claim 8,
The information on the file is,
A history of the file generated, a path of the file to the host, a history of the file previously executed, a history of modification of the file, or signature information of the file
How to diagnose malware.
delete delete 9. The method of claim 8,
After the sorting step,
Inserting marker information indicating the suspect file into the meta area of the suspicious file
The method comprising the steps of:
9. The method of claim 8,
Wherein the predetermined external inflow path includes:
A path through which the file is transferred to the host via a web browser, an e-mail, or a removable disk, or a path through which a predetermined program is run on the host
How to diagnose malware.

Images