MALWARE DETECTION AND CLASSIFICATION METHOD AND SYSTEM THAT USES BENIGN OR MALICIOUS APPLICATION PREFERRED FEATURE FUNCTION FOR MALWARE DETECTION AND CLASSIFICATION

摘要

The present invention relates to a technique for detecting and classifying malware for classifying feature functions such as application program interface (API), permission, etc. which are essentially included in an application into those used by many normal apps and those used by many malicious apps and for using a list of classified preference features to diagnose malware infections in applications. The system comprises: a feature extraction unit that extracts feature functions included in the diagnostic target app; and a malignant code diagnosis unit that diagnoses whether a target app contains malware using a normal list of feature functions extracted from a normal app group without malware or a malicious list of feature functions extracted from a malicious app group with malware.