# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Detection Techniques in Security Control Systems
\begin{table}
\begin{tabular}{c c} \hline
**Detection Methods** & **Detection Techniques** \\ \hline \multirow{6}{*}{Reinforcement learning} & Q-learning \\ \cline{2-3}  & Deep Q-Network \\ \cline{2-3}  & Generative adversarial \\ \cline{2-3}  & network (GAN) \\ \hline \multirow{2}{*}{Other detection methods} & Packer detection and unpacking \\ \cline{2-3}  & Malware-clustering technique \\ \hline \end{tabular}
\end{table} 
Table 3: _Cont._external attacks, availability and clustering capabilities, and intrusion detection capabilities. Host-based systems detect intrusions by detecting the signature of the file on the host or analyzing the behavior information of the running system. They also perform resource information file analysis, accurate detection and analysis, real-time log analysis, and the detection of attack attempts at the internal user and user levels. Misuse detection and abnormal detection are classified in terms of the analytical methods they involve. Misuse detection is a method of detecting malicious code by defining rules of known behavior and signatures, such as in signature-based detection techniques. Abnormal behavior detection is a method of detecting malicious behavior when a behavior is not included in a benign model after defining a model of benign behavior in a network and host. Data mining and statistical methods can be used to define models of benign behavior [11; 13; 22; 29]. An IPS (Intrusion Prevention System) is very similar to an intrusion detection system. However, unlike IDS, this technique blocks IP addresses and ports to prevent intrusion as much as possible. Therefore, the advantages and disadvantages of IDS are directly inherited by IPS. Currently, multi-segment technology is widely used to divide one piece of equipment into several pieces of equipment, and various techniques to prevent intrusion are actively being developed [11]. The purpose of network forensic techniques is not to detect and prevent intrusions, but to provide additional information for the forensic analysis of intrusions. This technique collects and stores all traffic input and output data from and to the network, analyzes the stored traffic when an intrusion occurs, and obtains information such as the download path and the secondary traffic after infection. Therefore, the results of the analysis are used to prevent intrusion in a more precise manner. Recently, due to the development of smartphone technology and the diversity of instant messaging (IM) software, defenders use packet sniffing techniques based on rule-based extraction methods to identify the IP addresses of cyber attackers [29; 36; 37; 38]. An APT dedicated solution is similar to an existing security solution, but is APT-specific. This is an evolutionary solution that detects APT attacks that go undetected by existing security solutions using behavior-based analysis. It can be divided into host-based solutions and network-based solutions. A host-based solution has the advantage of detecting APT attacks by searching the host files and monitoring them in real time. However, it has a disadvantage in that it cannot detect unknown attacks. A network-based solution detects intrusions without affecting the real system by detecting and blocking malicious traffic by virtualizing inbound and outbound traffic to the network. This solution is advantageous in that it can easily conduct analyses by storing the detection and replay packets more accurately than existing security solutions by analyzing the secondary action. Nevertheless, since there is no distinction between clients in the organization, there are disadvantages in that it does not detect the spread of malware through correlation analysis, and it does not detect the spread through backdoor portals after penetration via USB.