# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Behavior-Based Detection Method
This method involves detecting malicious behaviors by analyzing processes and files, registry creation and modification, network activities, and API call flow in an emulator and virtual machine in such a way as to not affect the actual system. When the emulator and the virtual machine are utilized, it is necessary to construct the environment and to prepare for API hooking in order to analyze the API call flow. Through API hooking, the situation can be monitored by collecting all of the information about API calling, and behaviors can be analyzed during execution by tracking the file, registry, process, network connection, etc. Therefore, this method is advantageous in that it is logically separated and does not affect the actual system, which can quickly be recovered to its pre-infection state even if the malicious code is executed, and the behavior can be accurately analyzed because the code is being executed at the time of analysis. However, analysis is difficult when malicious code is executed in a specific environment and under certain conditions, and only a part of the analysis can be performed, rather than analyzing all execution processes. To solve the problems of static and dynamic analysis methods, a hybrid analysis method has emerged that solves the shortcomings of each analysis method and leverages the advantages of each one. The authors of [80] developed a framework for the detection of malicious code using both static and dynamic analysis methods. In addition, [81] uses both static and dynamic analysis methods, but only static analysis is performed in the test process whereas only dynamic analysis is used in the training process. By applying both the static and dynamic analysis methods as needed, the effectiveness of malicious code detection is increased [80; 81; 82]. Moreover, this method is classified into system-based and network-based detection methods according to the analytical targets of the behavior. The system-based detection method detects malicious behaviors based on the CPU, memory usage, and registry value and device ID that are generated when the program is executed. The network-based detection method analyzes network traffic and detects malicious behaviors stemming from network connections and transmitted packets. Specifically, the system-based detection method can be classified into the integrity check technique and behavior monitoring and blocking method based on the precise method of detecting malicious behaviors. There are also other methods that use API call behavior detection, visualization, behavior-dependent graphs, traffic characteristics, abnormal behavior detection, system call sequence state-based detection, and fuzzy logic and genetic algorithms [10; 13; 26; 28; 30; 83; 84; 85; 86; 87; 88; 89; 90; 91; 92; 93; 94]. As advancements continue to be made in malware analysis methods, malware creators use various obfuscation techniques, such as compression and encryption techniques, to hide specific signatures or malicious segments. Entropy-based malicious code analysis methods have been introduced to detect obfuscated malicious codes. Obfuscated malware, such as compressed and encrypted malware, has higher entropy than conventional malware. It is therefore possible to detect malicious codes due to the presence of high-entropy files. Recently, to improve the entropy-based malicious code analysis method, more reliable results were derived by introducing different entropy criteria and various entropy measurement methods for each file format, and the methods were verified to be models with optimal performance by applying various machine learning models [95; 96]. However, entropy-based malicious code detection methods have several limitations. First, false positive detection of an actual encrypted file as a malicious code may occur. Second, the entropy of the plaintext for each file format is higher than that of the encrypted file. Third, it is difficult to calculate the entropy of files that have large sizes.