Patent ID: 8181248
Filing Date: 2012-05-15
Classification: G06F

Abstract:
1. An anomaly malicious code detection system using a process behavior prediction technique, comprising: a DB filtering module configured to perform primary malicious code filtering with respect to execution codes executed in a target system; a system resource monitor module operated by a processor device and configured to monitor a plurality of system resources to collect information of events that are generated by the execution codes executed in the target system, the collected event information being in the form of a plurality of resource logs corresponding to the plurality of system resources; a reprocessing module configured to reprocess the collected event information to construct, from the collected event information, one integrated log representing a related behavior feature value of the execution codes, the integrated log having a plurality of records, each of the records representing an event and including a portion of the resource logs which corresponds to the event; a behavior prediction information processing module configured to input the constructed integrated log into a learning algorithm to extract a malicious behavior feature value as a prediction pattern; and an anomaly malicious behavior detection module configured to compare the extracted malicious behavior feature value with a related behavior feature value that is constructed in the reprocessing module to detect a malicious behavior, wherein the system resources are file system, process, registry, service, and network items, and the system resource monitor module comprises: