公开(公告)号：US10007789B2

公开(公告)日：2018-06-26

申请号：US15240319

申请日：2016-08-18

Applicant: ELECTRONICS AND TELECOMMUNICATIONS RESEARCH INSTITUTE

Inventor： Hyun Joo Kim ,  Jong Hyun Kim ,  Ik Kyun Kim

IPC: G06F21/56 ,  G06N5/02

CPC classification number: G06F21/566 ,  G06N5/003 ,  G06N5/022 ,  G06N20/00

Abstract: The present invention relates to an apparatus and a method for detecting a malware code by generating and analyzing behavior pattern. A malware code detecting apparatus includes a behavior pattern generating unit which defines a characteristic parameter which distinguishes and specifies behaviors of a malware code and normally executable programs, converts an API calling event corresponding to the defined characteristic parameter and generates a behavior pattern in accordance with a similarity for behaviors of converted API call sequences to store the behavior pattern in a behavior pattern DB; and a malware code detecting unit which converts the API calling event corresponding to the defined characteristic parameter when the target process is executed into the API call sequence and determines whether the behavior pattern is a malware code in accordance with a similarity for behaviors of the converted API call sequence and the sequence stored in the behavior pattern DB.

公开(公告)号：US09537887B2

公开(公告)日：2017-01-03

申请号：US14635962

申请日：2015-03-02

Applicant: Electronics and Telecommunications Research Institute

Inventor： Yang Seo Choi ,  Ik Kyun Kim ,  Min Ho Han ,  Jung Tae Kim ,  Jong Hyun Kim

IPC: G06F21/00 ,  H04L29/06 ,  H04L12/26 ,  G06F21/55

CPC classification number: H04L63/1441 ,  H04L63/1416 ,  H04L63/1425

Abstract: Disclosed are provided a method and a system for network connection chain traceback by using network flow data in order to trace an attack source site for cyber hacking attacks that goes by way of various sites without addition of new equipment of a network or modification a standard protocol when the cyber hacking attack occurs in the Internet and an internal network.

Abstract translation: 提供了一种通过使用网络流数据来网络连接链追溯的方法和系统，以便跟踪通过各种站点进行的网络黑客攻击的攻击源站点，而不添加网络的新设备或修改标准协议 当网络黑客攻击发生在互联网和内部网络时。