# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Virtualization-Based Detection Method
Moreover, malicious codes are not detected when techniques for bypassing detection of malicious code are used; examples of such techniques include the human interaction technique, which only operates when performing specific actions; the anti-debugging technique, which does not perform malicious actions when the tool that analyzes malicious code is executed; and the anti-virtual machine technique, which does not perform malicious actions when executed in a virtual environment. Detection can also be bypassed if the malicious code is packed, if the malicious code has a built-in latency period that makes it wait until it has passed through the sandbox, and if the malicious code has a time trigger that causes it to run only on certain dates and times [10; 13; 85; 118; 119; 120; 121]. The machine learning-based malicious code analysis method is similar to the big data-based detection method. It detects malicious codes based on features that appear in a large amount of data. The biggest difference between the two methods is that the former learns a model. Machine learning-based malware detection methods have emerged to address the fundamental problems associated with traditional malware detection methods, such as security systems, pattern-based detection, heuristic-based detection, reputation-based detection, behavior-based detection, virtualization-based detection, anomaly detection, and big data-based detection. The known problems with existing methods include the inability to detect unknown new and variant malware and difficulty in detecting and counteracting zero-day attacks in pattern-based detection; high false positive and false negative rates caused by difficulty defining similarity criteria in heuristic-based detection; the need to install an additional program to obtain reputation, the difficulty of detection using network traffic analysis, and the requirement for fundamental combinations with other detection methods due to high false positive and false negative rates in reputation-based detection; the need to spend a lot of time and effort on manual analysis of malicious code and difficulty analyzing malicious code that is encrypted or packed in static analysis; difficulty with malicious code running in specific environments and conditions in dynamic analysis; the need for additional resources to reduce the false positive and false negative rates and unsuitability for use with unstructured data in anomaly detection; and dependence on the validity and size of the data in big data-based detection. In attempts to overcome these limitations, various malicious code detection methods based on machine learning have been researched. Machine learning can be classified into supervised learning, unsupervised learning, and reinforcement learning according to the learning method, and various models are used for learning [73]. Supervised learning is used to infer a function from training data that is used in regression analysis to predict the functional relationship between different data classes. Unsupervised learning differs from supervised learning, where the target value of the input value is not given. Reinforcement learning is a method of choosing the action or sequence of actions that provides the most reward among various options. Various machine learning models have emerged, as described above, and they can be used in conjunction with existing malicious code detection methods, such as security control system, pattern-based malicious code detection, and heuristic-based detection. The recent trend in malware detection and prevention research is not to propose new detection methods, but rather to apply machine learning algorithms to existing malware detection methods. Hence, future research examining malicious code detection is expected to produce more effective methods of detecting and preventing malware using machine learning models [122; 123; 124; 125; 126; 127].