An electronic device is disclosed. An electronic device according to various embodiments comprises: a processor; and a memory electrically connected to the processor, wherein the processor may be configured to: obtain a plurality of first parameters associated with attributes of at least one malicious code and a plurality of second parameters associated with a system in which the at least one malicious code is executed; obtain a similarity on the basis of a first comparison result according to a first comparison method between the plurality of first parameters and a second comparison result according to a second comparison method between the plurality of second parameters; and classify the at least one malicious code into at least one cluster on the basis of the similarity between the at least one malicious code. Other various embodiments may be provided.