# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 3 Malicious Code Attack Scenario  
APT attack scenarios can be classified into six stages: preliminary investigation, penetration, latency, internal search, internal activity, and purpose achievement. This attack scenario is illustrated in Figure 1.  
In the preliminary investigation step, the attacker prepares for the future attack phases; this may include information gathering and analysis in addition to other types of attack preparation. The information gathering and analysis process involves collecting information such as the homepage of the attack target, Social Networking Service (SNS) [12], internal organizational structure, employee name and contact information, type of software, partner companies, frequently accessed web sites and Storage as a Service (StaaS), etc. Using the collected information, it is necessary to use an attack preparation process to collect vulnerability information for future penetration, and the attacker acquires a base for attack through this process. In the attack preparation process, to collect vulnerability information, the attacker obtains information related to the people who have access to the secure information necessary for the attack by investigating intrusive ports using technical port scan or non-technical social engineering techniques. Once vulnerability information is gathered and the target information is determined, the attacker creates a dedicated injection tool and writes malicious code that exploits the vulnerabilities of the target. The attacker also manipulates frequently accessed web sites and web hardware to upload the attack tool and malicious code. Then, when the attacked internal employee accesses the manipulated web sites, the uploaded malicious code is downloaded and successfully penetrates the system. Moreover, an external attacker can procure a C & C (Command & Control) server for communication with the internal network, and they can prepare for attacks through spear phishing and USB infection for future penetration. The preliminary investigation step is not itself an attack, because it mostly involves information gathering. It is therefore difficult to effectively detect attacks at this stage [10; 11; 12; 22]. In the penetration step, the attacker infects the victim's system with malicious code generated by the attacker based on the information collected in the previous preliminary investigation step. Next, the internal network is penetrated into, thereby practically performing the attack, and the target system is infected with malicious code, mainly by using social engineering techniques. The attacker mainly targets the administrator of the internal organization, the main system, the security officer, and the network manager based on the information collected in the previous step, as these people have the authority to access security information. To infect the systems of these victims, the preparation for the penetration in the previous step is completed by uploading specially designed malicious code, such as  
Figure 1: APT attack scenario. is the case in a zero-day attack, which involves bypassing anti-virus software, collecting information, and communicating with the C&C server. This step infects malicious code into the internal system through a spear phishing attack that send e-mails to the selected victims, and by opening up access to manipulated web sites. The attacker sends items such as personal information, social issues, personal card bills, and shopping mall delivery information to the e-mail to get the victims to read the e-mail and/or execute the attachment file. In this way, the target system is infected with malicious code through the drive-by download technique and watering hole attachment technique by executing the attached malicious code or inducing a connection to the manipulated web site and update server. Therefore, a defender is limited in their ability to detect such an attack in this step because the attacker uses social engineering techniques and zero-day vulnerabilities.