KR101907681B1 - Method, apparatus, and system for automatically generating rule for detecting virus code, and computer readable recording medium for reciring the same - Google Patents

Abstract

The present invention discloses a method, apparatus, and system for automatic rule generation for malicious code detection and a computer-readable recording medium recording the same. A method for generating automatic rules for malicious code detection according to the present invention includes extracting a plurality of system calls by executing a plurality of malicious codes and a normal program according to the automatic rule generation method for detecting malicious codes, The method comprising the steps of: assigning a score using the number of times executed in the program; extracting a system call in which the given score difference is equal to or greater than a threshold value; and extracting a pattern of an extracted system call of each malicious code among the plurality of malicious codes, Setting a system call pattern of the malicious code as a system call pattern, grouping the system call patterns of each malicious code based on the degree of similarity, and grouping the system call pattern of the grouped malicious code using a multiple sequence alignment algorithm Selecting representative patterns of the respective groups and generating them as malicious code detection rules, Comparing the pattern of the system call code property detection rule and a new program to be executed and a step for determining the infection. According to the present invention, a malicious code can be detected by using a pattern even when a system call which is not used in the malicious code is inserted in the middle by detecting the malicious code using the pattern of the system call.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to an automatic rule generation method, an apparatus, a system, and a computer readable recording medium for detecting malicious codes. 2. Description of the Related Art [0002]

The present invention relates to an automatic rule generation method, an automatic rule generation apparatus, an automatic rule generation system, and a computer readable recording medium on which the automatic rule generation system, automatic rule generation system, and automatic rule generation method for malicious code detection that automatically generates rules for detecting malicious codes to be changed.

Anti-virus software, which is often used to detect malicious code, uses signature-based detection techniques. The signature-based detection method stores a hash value of a malicious program as a signature, calculates a hash value when a suspicious program is executed, and compares the hash value with a stored signature to determine whether or not the malicious code is present. However, attackers who know about antivirus malware detection techniques in advance know how to modify the hash value by propagating the virus through the code modification for the malicious code. In this case, since the hash value used as the signature has changed, it can not be detected as the previously stored signature.

To overcome these drawbacks, an action-based detection technique is used to track system calls generated by the program and to analyze malicious behavior by analyzing tracked system calls. In the case of behavior-based detection, there are numerous system calls generated by the program. Therefore, system overloading can occur if a method of tracking all system calls is applied to a real system. Also, it is necessary to study what system call to trace. However, as a method of tracking such a system call, when a system call that is not classified as a malicious action is called in the middle, the proportion of the system call used for malicious action on the entire system call is lowered as the signature is changed. There is a problem that it is difficult to detect. Therefore, it is necessary to study the malicious code detection method when inserting such changed system call.

An object of the present invention is to update a malicious code detection rule by detecting a malicious code using a pattern of a system call and reflecting a pattern of a new malicious code in order to solve the above-described problems and other problems.

According to an aspect of the present invention, there is provided a computer readable medium storing a program for causing a computer to execute a method comprising: extracting a plurality of system calls by executing a plurality of malicious codes and a normal program; The method includes the steps of: assigning a score using the number of times executed in the normal program; extracting a system call in which the given score difference is equal to or greater than a threshold value; and extracting a pattern of an extracted system call of each malicious code among the plurality of malicious codes, Setting a system call pattern of each malicious code based on the degree of similarity; grouping the system call pattern of the grouped malicious code by a multiple sequence alignment algorithm A representative pattern of each group is selected and used as a malicious code detection rule, And comparing the detected malicious code detection rule with the system call pattern of the newly executed program to identify malicious code.

The automatic rule generation method for detecting a malicious code according to the present invention may further include a step of identifying a malicious code, and then, when it is determined that the newly executed program is a malicious code, And updating the system call pattern of the malicious code with the system call pattern of the malicious code.

In the step of grouping based on the similarity, the similarity between the updated system call pattern of the malicious code and the existing system call pattern of the malicious code may be compared to group the malicious code having the set similarity or more into one group.

The automatic rule generation method for malicious code detection includes storing the generated malicious code detection rule in a database between a step of generating a malicious code detection rule by selecting a representative pattern of each group and a step of discriminating the malicious code As shown in FIG.

The step of storing in the database may store the name of each group, the representative pattern of each group, the system call pattern of the malicious code included in each group, and the detection count in a matching manner.

A normal program may represent a program installed by default when a Windows OS is installed or a program approved by the Windows OS administrator.

The grouping based on the degree of similarity can be grouped by applying at least one clustering algorithm among a hierarchical clustering algorithm, a maximum distance algorithm, a K average algorithm, an Isodata algorithm, or a Robin-Munro algorithm.

According to another aspect of the present invention, there is provided a computer-readable recording medium storing a program for executing each step of automatic rule generation method for detecting malicious code on a computer.

According to another aspect of the present invention, there is provided a computer readable recording medium storing a program for causing a computer to function as: a log extracting unit for extracting a plurality of system calls by executing a plurality of malicious codes and a normal program; Each of the plurality of malicious codes and a number of times executed in the normal program, and extracts a system call in which the score difference is equal to or greater than a threshold value, A group generating unit for grouping the system call patterns of the malicious codes based on the degree of similarity, a group generating unit for grouping the system call patterns of the grouped malicious codes into the system call patterns of the malicious codes, Multiple pattern alignment algorithms are used to select representative patterns of each group to detect malicious codes And a malicious code discriminator for discriminating a malicious code by comparing the generated malicious code detection rule with a system call pattern of a newly executed program, wherein the malicious code detection rule generator generates a malicious code detection rule Device.

The pattern setting unit may update the system call pattern of the newly executed program with the system call pattern of the malicious code when the malicious code discrimination unit determines that the newly executed program is a malicious code.

The group generating unit may compare the similarity of the system call pattern of the updated malicious code with the system call pattern of the existing malicious code to group the malicious codes having the set similarity or more into one group.

According to another aspect of the present invention, there is provided a malicious code detection system, comprising: a server for storing a malicious code identification application; and a malicious code detection application installed in the server, And extracts a plurality of system calls of each malicious code among the plurality of malicious codes by using each of the extracted malicious codes and the number of times executed in the normal program, Extracts malicious codes from malicious codes, groups system call patterns of malicious codes based on similarity, selects representative patterns of each group using a multiple sequence alignment algorithm, generates malicious code detection rules, Malicious code detection rules and system call patterns of newly executed programs. And an automatic rule generation system for malicious code detection including a user terminal that compares malicious codes with each other.

The automatic rule generation method, the automatic rule generation apparatus, the automatic rule generation system, and the computer-readable recording medium recording the malicious code according to the present invention will now be described.

According to at least one of the embodiments of the present invention, malicious code can be detected using a pattern even when a system call that is not used in malicious code is inserted in the middle by detecting a malicious code using a pattern of the system call .

In addition, according to at least one of the embodiments of the present invention, there is an advantage that it is adaptable to malicious code detection by updating a system call pattern of a malicious code by using a system call pattern of a new malicious code.

Further scope of applicability of the present invention will become apparent from the following detailed description. It should be understood, however, that the detailed description and specific examples, such as the preferred embodiments of the invention, are given by way of illustration only, since various changes and modifications within the spirit and scope of the invention will become apparent to those skilled in the art.

1 to 4 are flowcharts of an automatic rule generation method for malicious code detection according to an embodiment of the present invention.
5 is a schematic block diagram of an automatic rule generation apparatus for malicious code detection according to an embodiment of the present invention.
FIG. 6 is a schematic configuration diagram of an automatic rule generation system for malicious code detection according to an embodiment of the present invention.
7 is an exemplary diagram illustrating a malicious code detection method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals are used to designate identical or similar elements, and redundant description thereof will be omitted. The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role. In the following description of the embodiments of the present invention, a detailed description of related arts will be omitted when it is determined that the gist of the embodiments disclosed herein may be blurred. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. , ≪ / RTI > equivalents, and alternatives.

Terms including ordinals, such as first, second, etc., may be used to describe various elements, but the elements are not limited to these terms. The terms are used only for the purpose of distinguishing one component from another.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In the present application, the terms "comprises", "having", and the like are used to specify that a feature, a number, a step, an operation, an element, a component, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

The automatic rule generation device or user terminal for malicious code detection described herein may be a tablet PC, an ultrabook, a laptop, a computer, a mobile phone, a smart phone, a digital broadcasting terminal, a PDA personal digital assistants (PMPs), and portable multimedia players (PMPs).

1 to 4 are flowcharts of an automatic rule generation method for malicious code detection according to an embodiment of the present invention.

Referring to FIG. 1, an automatic rule generation method for malicious code detection according to an embodiment of the present invention extracts system calls of a normal program and a malicious code (S110), sets a system call pattern of a malicious code (S120 ), The malicious codes can be grouped (S130).

Specifically, the step of extracting a system call of a normal program and a malicious code (S110) may extract a plurality of malicious codes and a normal program as samples and extract a plurality of system calls. Here, a malicious program represents a program that interrupts the normal operation of a Windows OS, such as encrypting and deleting a specific file, or changing a different file into an encrypted file, and the normal program is a Windows OS Indicates a program installed by default or approved by the Windows OS administrator. For example, a malicious program can be Ransomware, a Trojan horse, and a normal program can be a Notepad installed in a Windows OS, Windows Explorer, and the like.

Next, in step S120 of setting the system call pattern of the malicious code, the system call pattern of the normal program and the system call pattern of the malicious code are compared with the execution count of the system call of the malicious code, have.

Referring to FIG. 2, when a normal program or a malicious code is executed, the number of execution of the system call is checked (S122), and a score is given to each system call (S124). Specifically, when the system call "A" is used 10 times in the malicious code and twice in the normal program, a score of 8 is given to the "A" system call and the system call "B" When used 15 times in the normal program, each system call can be given a score by giving the score "-11" to the "B" system call.

(S126). If the score is equal to or greater than the threshold value, the system call pattern of each malicious code is set (S128). If the score is less than the threshold value, the system call pattern of the normal code can be set S128 '). In this case, the threshold value represents a reference value, and when the reference value is negative (-), it can be determined that the absolute value is greater than the threshold value when the absolute value is large. Specifically, when the score of the "A" system call is 8 and the score of the "B" system call is -11, the "A" system call is more likely to be used in the malicious code than the "B" system call, System call points can be used to extract system calls that are more likely to be used in malicious code. That is, by comparing the score of each system call with the reference score, it is possible to detect a system call that is more likely to be used in malicious code.

In this manner, a system call exceeding a threshold value can be sequentially detected in the malicious code, and the detected usage pattern can be detected by listing the detected system calls. The detected usage pattern can be set as the system call pattern of the malicious code.

Next, the grouping of the system call patterns of each malicious code (S130) can perform grouping based on the similarity degree of each system call pattern. Specifically, grouping can be performed by applying at least one clustering algorithm among a hierarchical clustering algorithm, a maximum distance algorithm, a K average algorithm, an Isodata algorithm, or a Robin-Monroe algorithm.

The degree of similarity can be calculated according to the number of malicious code system calls commonly included in the set malicious code system call. The malicious codes can be grouped according to the calculated similarity.

Next, the automatic rule generation method for malicious code detection according to the present invention generates a malicious code detection rule (S140), and can identify malicious code according to the generated rule (S150).

Specifically, the step of generating the malicious code detection rule (S140) can determine the pattern of the representative malicious code system call for each group. At this time, the system call pattern of grouped malicious codes can be determined as a malicious code detection rule of each group by selecting a representative pattern of each group using a multiple sequence alignment algorithm. The multi-sequence sorting algorithm refers to a method of grouping together malicious codes at a time when there are multiple system call patterns.

The generated malicious code detection rule (i.e., the representative pattern of each group) is compared with the system call pattern of the newly executed program to determine whether or not the malicious code is included and in which group the malicious code is included. For example, if the system call pattern of the first group of malicious codes is set to A-> D-> C-> D, then the specific program is A-> F-> D-> a-> b-> C-> D, the system call is executed in the order of A-> D-> C-> D, which is the system call pattern of the malicious code set, so it can be determined as a malicious code. That is, the specific program can be judged as the malicious code of the first group. If the degree of similarity equal to or greater than the threshold value is satisfied according to the degree of similarity, it can be determined that the first group of malicious codes is satisfied.

Referring to FIG. 7, in the system call of each malicious code, when the system call pattern likely to be used for the malicious code is set to A-> D-> E-> E-> D-> B, The similarity can be calculated according to the sequence of calls.

The first malicious code is executed with 10 system calls in the order of Sequence I, that is, in order of C, A, D, C, E, E, D, B, C, , E, D, B, D, C, A, C.

In this case, the first malicious code and the second malicious code can be calculated to have a degree of similarity of 0.6 with the set pattern, respectively, and can be determined to be malicious code if the preset degree of similarity is 0.5.

Referring to FIG. 3, in the automatic rule generation method for malicious code detection according to an embodiment of the present invention, when a newly executed program is determined to be a malicious code (S150) The system call pattern of the code can be updated (S160).

Specifically, if a malicious code distributor changed the system call of malicious code from A-> D-> C-> B pattern to A-> D-> b-> a-> C-> B pattern and distributed it, Malicious code is also detected as malicious code because it contains A-> D-> C-> B pattern set by system call pattern of malicious code. However, if malicious codes continuously distributed are distributed, some system calls are changed It may not be detected as malicious code. Therefore, the system call pattern of the changed malicious code, A-> D-> b-> a-> C-> B, can be updated to the system call pattern of the malicious code.

Next, the similarity between the updated system call pattern of the malicious code and the system call pattern of the existing malicious code is compared, and the malicious code having the set similarity or higher can be grouped into one group (S170). Specifically, the system call pattern of the changed malicious code, A-> D-> b-> a-> C-> B, is compared with the representative patterns of the groups to classify them into specific groups, The representative pattern can be determined by reapplying the system call pattern of the malicious code to the multi-sequence sorting algorithm.

By the above method, the system call pattern of the modified malicious code can be continuously reflected in setting the representative pattern of the malicious code.

Referring to FIG. 4, an automatic rule generation method for malicious code detection according to an exemplary embodiment of the present invention includes generating a malicious code detection rule by selecting a representative pattern of each group (S140) (S145) storing the generated malicious code detection rule in a database between the malicious code detection rule and the malicious code detection rule (S150).

Specifically, the name of each group in which the malicious code is classified, the representative pattern of each group, the system call pattern of the malicious code included in each group, and the detection frequency can be matched and stored. If a new malicious code is detected, You can update the database with the changed system call pattern of the code, the grouped group, and so on.

5 is a schematic block diagram of an automatic rule generation apparatus for malicious code detection according to an embodiment of the present invention.

5, an automatic rule generation apparatus 100 for detecting a malicious code according to an exemplary embodiment of the present invention includes a log extraction unit 110, a pattern setting unit 120, a group generating unit 130, a malicious code A detection rule generation unit 140, and a malicious code determination unit 150. In addition, the automatic rule generation apparatus 100 for detecting a malicious code may further include a database (DB) 160 for storing information related to a malicious code.

The log extracting unit 110 can extract a large number of system calls by executing a plurality of malicious codes and a normal program. That is, each malicious code selected by the sample and the normal program are executed to extract the system call, and the execution frequency and execution order of each system call can be extracted.

The pattern generating unit 120 may assign scores to each of the plurality of system calls extracted by the log extracting unit 110 using the number of malicious codes and the number of times the malicious codes are executed in the normal program. The pattern generating unit 120 may extract a system call having a score difference equal to or greater than a threshold value and set a pattern of the extracted system call of each malicious code among a plurality of malicious codes as a system call pattern of each malicious code . A concrete method of setting the system call pattern has been described in detail in FIG.

The group generating unit 130 may group the system call patterns of each malicious code based on the degree of similarity. The system call pattern of the malicious code included in each group can be classified to have a degree of similarity equal to or greater than a set reference value. The group generating unit 130 may group at least one of the hierarchical clustering algorithm, the maximum distance algorithm, the K average algorithm, the Isodata algorithm, and the Robin-Monroe algorithm.

The malicious code detection rule generation unit 140 may generate a malicious code detection pattern by selecting a representative pattern of each group by using a multiple sequence alignment algorithm for a system call pattern of grouped malicious codes. A system call pattern of a plurality of malicious codes included in one group is listed and a representative system call pattern of malicious codes of each group is determined using a plurality of system call patterns and set as a malicious code detection rule.

The malicious code discrimination unit 150 can discriminate the malicious code by comparing the generated malicious code detection rule with the system call pattern of the newly executed program. At this time, the malicious code discrimination unit 150 can discriminate the malicious code if the degree of similarity is equal to or greater than a preset degree of similarity. In this case, the malicious code discrimination unit 150 compares the similarity with the representative pattern of each group, and if the malicious code is discriminated, it can be reclassified as malicious code of the corresponding group.

When the malicious code determining unit 150 determines that the newly executed program is a malicious code, the pattern setting unit 120 updates the system call pattern of the newly executed program with the system call pattern of the malicious code have. That is, the database can be updated to include it as one of the malicious code patterns of the group, and the representative pattern can be determined in the pool containing the new malicious code pattern. Also, the detected malicious code is not included in the corresponding group, and the similarity between the system call pattern of the malicious code updated in the group generating unit 130 and the system call pattern of the existing malicious code is compared, Can be grouped into one group, and a representative pattern of the group whose pool has been changed can be newly determined.

The database 160 may store the generated malicious code detection rule. At this time, the database 160 may store the name of each group, the representative pattern of each group, the system call pattern of the malicious code included in each group, and the detection count in a matching manner.

FIG. 6 is a schematic configuration diagram of an automatic rule generation system for malicious code detection according to an embodiment of the present invention.

6, an automatic rule generation system 1000 for malicious code detection according to an embodiment of the present invention may include at least one user terminal 100A, 100B, 100C and a server 200 have.

First, the server 200 stores a malicious code discrimination application. When the malicious code discrimination application is connected to the user terminals 100A, 100B, and 100C by wired / wireless connection and receives a download request of the malicious code discrimination application, 100A, 100B, and 100C.

The user terminals 100A, 100B and 100C can request the malicious code discrimination application from the server 200 and download and install the malicious code discrimination application. When the malicious code discrimination application is installed, the user terminals 100A, 100B, and 100C execute a plurality of malicious codes and normal programs to extract a plurality of system calls, and each of the extracted system calls includes a plurality of malicious codes And the number of times executed in the normal program, the system call pattern of each malicious code among a plurality of malicious codes can be extracted. Next, the user terminals 100A, 100B, and 100C group the system call patterns of the malicious codes based on the degree of similarity, select a representative pattern of each group using a multiple sequence alignment algorithm, The malicious code can be identified by comparing the generated malicious code detection rule with the system call pattern of the newly executed program.

When the newly executed program is determined to be malicious code, the user terminals 100A, 100B, and 100C installed with the malicious code detection application update the system call pattern of the newly executed program with the system call pattern of the malicious code , Representative patterns of each group can be selected. That is, the user terminals 100A, 100B, and 100C may function as automatic rule generation devices for detecting malicious codes.

According to the present invention, even when a system call which is not used in a malicious code is inserted in the middle by detecting a malicious code by using a pattern of the system call, the malicious code can be detected using the pattern, It is possible to adaptively cope with malicious code detection by updating the pattern of the system call of the malicious code by using the pattern.

According to another aspect of the present invention, there is provided a computer-readable recording medium having recorded thereon a program for performing each step of automatic rule generation method for malicious code detection on a computer.

The present invention described above can be embodied as computer-readable codes on a medium on which a program is recorded. The computer readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of the computer readable medium include a hard disk drive (HDD), a solid state disk (SSD), a silicon disk drive (SDD), a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, . Also, the computer may include a control unit 180 of the terminal. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

1000: Automatic rule generation system for malicious code detection
100A, 100B, 100C: user terminal 200: server
100: Automatic rule generation device for malicious code detection
110: log extracting unit 120: pattern setting unit
130: group generation unit 140: malicious code detection rule generation unit
150: malicious code discrimination unit 160: database (DB)

Claims (17)

Executing a plurality of malicious codes and a normal program to extract a plurality of system calls;
Assigning a score to each of the plurality of extracted system calls using the number of malicious codes and the number of times executed in the normal program;
Extracting a system call having the given score difference equal to or greater than a threshold value and setting a pattern of an extracted system call of each malicious code among the plurality of malicious codes as a system call pattern of each malicious code;
Grouping the system call patterns of each malicious code based on the degree of similarity;
Selecting a representative pattern of each group using a multiple sequence alignment algorithm to generate a malicious code detection rule for the system call pattern of the grouped malicious code; And
Determining malicious code by comparing the generated malicious code detection rule with a system call pattern of a newly executed program;
A method for generating an automatic rule for detecting a malicious code.
The method according to claim 1,
After determining the malicious code,
And updating the system call pattern of the newly executed program with the system call pattern of the malicious code when it is determined that the newly executed program is a malicious code.
3. The method of claim 2,
The grouping based on the degree of similarity may include grouping the malicious code having the set similarity or more into one group by comparing the similarity between the updated system call pattern of the malicious code and the system call pattern of the existing malicious code, How to create automated rules.
The method according to claim 1,
A step of selecting a representative pattern of each group and generating a malicious code detection rule, and a step of discriminating the malicious code,
And storing the generated malicious code detection rule in a database.
5. The method of claim 4,
Wherein the step of storing in the database stores the name of each group, the representative pattern of each group, and the system call pattern of the malicious code included in each group and the detected number in a matching manner. How to create automated rules.
The method according to claim 1,
Wherein the normal program is a program installed by default when a Windows OS is installed or a program approved by the Windows OS administrator.
The method according to claim 1,
The grouping based on the degree of similarity is performed by applying at least one clustering algorithm among a hierarchical clustering algorithm, a maximum distance algorithm, a K average algorithm, an Isodata algorithm, or a Robin- How to create automated rules for.
A computer-readable recording medium having recorded thereon a computer program for performing each step of a method for generating automatic rules for detecting malicious codes according to any one of claims 1 to 7 on a computer.
A log extracting unit for executing a plurality of malicious codes and a normal program to extract a plurality of system calls;
The system extracts a plurality of system calls extracted from the log extracting unit by using the number of malicious codes and the number of times executed in the normal program, extracts a system call in which the score difference is equal to or greater than a threshold value, A pattern setting unit configured to set a pattern of an extracted system call of each malicious code among malicious codes as a system call pattern of each malicious code;
A group generating unit for grouping the system call patterns of the malicious codes based on the degree of similarity;
A malicious code detection rule generation unit for generating a malicious code detection rule by selecting a representative pattern of each group by using a multiple sequence alignment algorithm for the system call pattern of the grouped malicious codes; And
A malicious code discrimination unit for discriminating a malicious code by comparing the generated malicious code detection rule with a system call pattern of a newly executed program;
And an automatic rule generation device for detecting a malicious code.
10. The method of claim 9,
Wherein the pattern setting unit updates the system call pattern of the newly executed program with the system call pattern of the malicious code when the malicious code discrimination unit determines that the newly executed program is a malicious code Automatic rule generation device for malicious code detection.
11. The method of claim 10,
Wherein the group generating unit compares the system call pattern of the updated malicious code with the similarity of the system call pattern of the existing malicious code and groups the malicious code having the set similarity or more into one group.
10. The method of claim 9,
And a database for storing the generated malicious code detection rule.
13. The method of claim 12,
Wherein the database stores a name of each group, a representative pattern of each group, a system call pattern of a malicious code included in each group, and a detection count in a matching manner. .
10. The method of claim 9,
Wherein the normal program represents a program installed as a default when a Windows OS is installed or a program approved by the Windows OS administrator.
10. The method of claim 9,
Wherein the group generating unit groups at least one clustering algorithm among a hierarchical clustering algorithm, a maximum distance algorithm, a K average algorithm, an Isodata algorithm, or a Robin-Monroe law algorithm, .
A server for storing a malicious code discrimination application; And
And downloading and installing the malicious code discrimination application from the server, extracting a plurality of system calls by executing a plurality of malicious codes and a normal program, wherein each of the extracted plurality of system calls includes the malicious code and the normal program Extracting a system call pattern of each malicious code among the plurality of malicious codes, grouping the system call patterns of each malicious code based on the degree of similarity, performing multiple sequence alignment, A user terminal for selecting a representative pattern of each group using an algorithm and generating a malicious code detection rule, comparing the generated malicious code detection rule with a system call pattern of a newly executed program to discriminate malicious code;
An automatic rule generation system for malicious code detection.
17. The method of claim 16,
The user terminal comprises:
And when the newly executed program is determined to be a malicious code, the system call pattern of the newly executed program is updated to the system call pattern of the malicious code, and then the representative pattern of each group is selected Automatic Rule Generation System for Code Detection.

Images