# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Detection Techniques in Security Control Systems
Therefore, defenders tend to prefer high-interaction client honeypots such as HoneyMonkey, Capture-HPC, etc. HoneyMonkey is a honeypot provided by Microsoft Corporation that visits suspicious URLs using Internet Explorer, monitors actions such as file and registry changes that occur during the execution of the generated file, and prevents the system from being infected by preventing the downloaded malicious program from running. Capture-HPC is a honeypot that uses VMWare, a virtual environment machine, to detect unusual changes by monitoring the state of the system by visiting suspicious URLs. In recent years, with the developments associated with the emergence of the Fourth Industrial Revolution, the use of Honeypot, which was previously limited to use with web pages, has also been used as a technology for cloud security. Moreover, research aiming to design smart agents for cybersecurity by incorporating machine learning technology is actively progressing [13; 40; 41; 42; 43; 44; 45; 46; 47; 48; 49; 50]. The internal information leakage prevention technique prevents sensitive information stored in systems in the network from being leaked to the outside. This is performed by logging, searching for, and blocking important and confidential information by analyzing packets transmitted to the outside via services such as web mail, web hard, and P2P. However, the detection rate is low, and excessive detection occurs because it is difficult to define important information, so this technique is not used often for actual filtering purposes. Instead, it is used for post-tracking purposes through file archiving. Typical examples include SCM (Secure Content Management), OCC (Outbound Content Compliance), ILD (Information Leakage Detection and Prevention), and CMF (Content Monitoring and Filtering). SCM is an integrated content security solution that provides four security functions: anti-virus, anti-spyware, web filtering, and message security. OCC can provide the monitoring, encryption, filtering, and blocking of contents that are leaked to the outside through IM (Instant Messaging), P2P, and FTP. ILD&P minimizes the illegal leakage of sensitive information that is protected by legal measures such as HIPPA, GLBA, SOX, the Japanese personal information protection law, and other technical measures; its aim is to prevent the leakage of confidential information through IM and P2P. CMF detects and blocks the leakage of confidential information by analyzing traffic that is delivered to the inside and outside based on predefined rules and policies. These techniques control the leakage of sensitive information by modulating the access, transmission permission, contents, and formation of the data. However, it is difficult to detect the leakage of such information when the information is leaked using a benign service, or when it is compressed and encrypted so that the information is not visible [11; 13; 51]. Secure USB is a technique for preventing an insider attacker from leaking internal confidential information using a USB storage device. This protects internal information from being leaked to the outside by monitoring the registered USB storage devices in the internal network, using user authentication and encryption functions to prevent information leakage due to theft or loss, and using erase functions to prevent device disassembly. However, it has a limitation in that it cannot directly and intelligently detect certain dangers such as the presence of confidential information [11; 52; 53; 54]. Systems are also protected through anti-spam filters and other similar functions. The main functions of a security control system are collecting information on security events such as network intrusion and system/network intrusion, and then reporting them in an integrated manner.