INTRUSION DETECTION METHOD OF A MALICIOUS SOFTWARE USING A VIRTUAL MACHINE, PARTICULARLY FOR DIRECTLY EXECUTING A CURIOUS FILE IN A VIRTUAL MACHINE

摘要

PURPOSE: An intrusion detection method of a malicious software using a virtual machine is provided to detect a malicious behavior by directly executing curious files in a virtual machine.;CONSTITUTION: A mail server(10) receives a mail to be transmitted to a receiver, and immediately transmits the mail to the receiver if there is not an attached file to the mail. If there is an attached file in the mail, the mail server transfers the attachment file to a VM(Virtual Machine) cluster(20). The mail server executes the attachment file in the VM cluster, and compares a system state image before and after the execution of the attachment file in the VM to detect a malicious code.;COPYRIGHT KIPO 2010