# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
###### Abstract  
According to the Fire-eye's M-Trends Annual Threat Report 2022, there are many advanced persistent threat (APT) attacks that are currently in use, and such continuous and specialized APT attacks cause serious damages attacks. As APT attacks continue to be active, there is a need for countermeasures to detect new and existing malicious codes. An APT attack is a type of intelligent attack that analyzes the target and exploits its vulnerabilities. It attempts to achieve a specific purpose, and is persistent in continuously attacking and threatening the system. With this background, this paper analyzes attack scenarios based on attack cases by malicious code, and surveys and analyzes attack techniques used in attack cases. Based on the results of the analysis, we classify and analyze malicious code detection techniques into security management systems, pattern-based detection, heuristic-based detection, reputation-based detection, behavior-based detection, virtualization-based detection, anomaly detection, data analysis-based detection (big data-based, machine learning-based), and others. This paper is expected to serve as a useful reference for detecting and preventing malicious codes. Specifically, this article is a surveyed review article. malicious code; detection technique; attack scenario; attack technique; APT attack +
Footnote †: journal: Medical Security  
techniques. It also combines attack techniques such as DBD (Drive-By-Download), SQL injection, malware and spyware, phishing, spam, spam, spear phishing, watering holes, and manual attacks, if the victim does not recognize the attacks [5; 6; 7]. An APT attack is defined as an intelligent (Advanced) analysis of vulnerabilities that satisfies the conditions of Persistent attacks, which involve multiple continuous attacks to achieve a specific purpose and to Threaten protected targets [4; 5; 8]. The Fire-eye's M-Trends Annual Threat Report 2022 classifies the factors of a recent APT attack as outside and inside, and these are listed in Table 1.  
The table above presents the APT attack detection ratio for solutions installed by APT defense solution vendors. Here, 'outside' of the infection notification indicates that the APT attack has been notified from the outside, while 'inside' of the infection notification means that the APT attack has been detected from the inside. Examining this trend, 94% of APT attacks were notified from the outside in 2011, but this value significantly decreased to 53% in 2019. In other words, although the rate of attacks being detected internally has increased through defense technology and the introduction of solutions against APT attacks, 50% of APT attacks are still notified of infection from the outside, which is still substantial [9]. Therefore, we analyze attack scenarios based on the above cases of malicious codes and survey, and we analyze the specific techniques used in these attacks. Based on the results of this analysis, we classify malicious code detection methods into security management systems, pattern-based detection methods, heuristic-based detection methods, reputation-based detection methods, behavior-based detection methods, virtualization-based detection methods, anomaly detection methods, big data-based detection methods, and other methods. The rest of this paper is organized as follows: The \"Attack cases by malicious codes\" section describes attack cases caused by existing malicious codes such as APT, and the \"Malicious code attack scenario\" section describes attack scenarios that involve penetrating into the system with malicious codes. The \"Attack techniques used by malicious code\" section explains the attack techniques that are employed when using malicious codes. Finally, the \"Classification and analysis of malicious code detection methods\" section describes the classification and analysis of the methods used to detect and thwart malicious codes.