公开(公告)号：US20170235945A1

公开(公告)日：2017-08-17

申请号：US15273984

申请日：2016-09-23

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Junghee LEE ,  Sangrok LEE

IPC: G06F21/52

CPC classification number: G06F21/52 ,  G06F21/566

Abstract: A malicious code analysis device and method used on an external device connected via a USB cable. The malicious code analysis method includes connecting a malicious code analysis device to an analysis target terminal, on which malicious code is to be executed, from outside the analysis target terminal via a USB cable, multi-booting the analysis target terminal based on multiple Operating System (OS) image files stored in the malicious code analysis device, providing user input to the analysis target terminal so that malicious code is incapable of recognizing that a current environment is an analysis environment, and analyzing, by the malicious code analysis device, the malicious code in consideration of both data modified by the malicious code, among pieces of data corresponding to the multiple OS image files, and the user input.

公开(公告)号：US20180046804A1

公开(公告)日：2018-02-15

申请号：US15404579

申请日：2017-01-12

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Sangrok LEE ,  Junghee LEE

IPC: G06F21/56 ,  G06F21/57

CPC classification number: G06F21/566 ,  G06F21/57

Abstract: An apparatus and method for monitoring the confidentiality and integrity of a target system. The apparatus for monitoring the confidentiality and integrity of a target system includes a target area information reception unit for receiving target area information about a target area of the target system and storing the target area information, a monitoring unit for extracting attack information by monitoring at least one of confidentiality, corresponding to a data load instruction, and integrity, corresponding to a data store instruction, based on the target area information, and an attack-handling unit for determining whether an attack is occurring based on the extracted attack information and for handling the attack when it is determined that an attack is occurring.