公开(公告)号：US20170103202A1

公开(公告)日：2017-04-13

申请号：US15274126

申请日：2016-09-23

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Sung-Jin KIM ,  Woomin HWANG ,  ByungJoon KIM ,  ChulWoo LEE ,  HyoungChun KIM

IPC: G06F21/53 ,  G06F21/56 ,  G06F9/455

CPC classification number: G06F21/566 ,  G06F9/45558 ,  G06F21/564 ,  G06F2009/45587

Abstract: An apparatus and method for monitoring a virtual machine based on a hypervisor. The method for monitoring a virtual machine based on a hypervisor includes monitoring an attempt to access an executable file located in a virtual machine, when the attempt to access the executable file is detected, extracting a system call transfer factor, input through a task that attempted to make access, acquiring, based on the system call transfer factor, an execution path corresponding to the executable file and a reference path corresponding to a reference file that is executed together with the executable file, and checking based on the execution path and the reference path whether any of the executable file and the reference file is malicious, and collecting a file in which malicious code is present when the malicious code is present in any of the executable file and the reference file.