An apparatus for detecting and preventing ransom-ware behavior using camouflage process a method thereof and computer recordable medium storing program to perform the method

摘要

The present invention relates to an apparatus for detecting and preventing ransomware behavior using a spoofing process, a method thereof, and a computer-readable recording medium in which a program for performing the method is recorded. According to the present invention, the apparatus for detecting and preventing ransomware behavior includes: a spoofing program creation module that generates and executes a spoofing program; and a spoofing program monitoring module which determines, when a program attempting to terminate the spoofing program is detected by monitoring the spoofing program, the detected program as ransomware, terminates the detected program, and isolates the detected program.