METHOD FOR ANALYZING FUNCTION OF MALICIOUS CODE USING API CALL SEQUENCE AND APPARATUS THEREOF

摘要

According to embodiments of the present invention, provided is an apparatus for analyzing a function of a malicious code, which abstracts lower level first behavior information into higher level second behavior information based on an action rule defined in consideration of parameters used in the API call and is capable of predicting the main purpose or core functions of a malicious code by estimating function information from the higher level second behavior information based on a function rule in accordance with the sequence.;COPYRIGHT KIPO 2019