# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Detection Techniques in Security Control Systems
Researchers have recently studied many detection methods to predict the signs of APT attacks by analyzing the network traffic with network flow and combining it with clustering methods to overcome the shortcomings of these network-based solutions, and a combination of machine learning and deep learning models is used for higher detection rates [11; 29; 39; 40]. The log analysis system responds to threats by analyzing logs of events in the system, detecting undesirable behaviors, and either informing the administrator about them or directly blocking them. These systems have the advantage of being more practical, because events that occur in the system result in various types of data, and various real-world situations can be derived from these. They include ESM (Enterprise Security Management), and SIEM (Security Information Event Management), which is an integrated security management system. It collects and manages logs generated by various security solutions and effectively manages and monitors these logs using analytical techniques such as correlation analysis, in-depth analysis, and association analysis. Thus, ESM makes it possible to detect and counteract various intrusions. SIEM is a combination of SIM and SEM; it manages and analyzes logs in a manner similar to ESM. However, unlike EMS,ESM takes a lot of time to process a large number of logs, as it must analyze short logs based on events and then process data based on a DBMS (Database Management System). SIEM was developed to overcome this issue of a prolonged processing time. It can analyze logs of data collected over a long period of time, as it uses big data processing technology, and it can do so quickly by using indexing-based processing [29]. The number of drive-by-download attacks, which are used to infect systems, has recently been increasing due to an increase in the rate at which web sites are accessed. Thus, there is a need for early detection and prevention of this type of attack. Various studies have attempted to develop such a method, including honeypots, which are widely used. A honeypot is a virtual system that analyzes and detects threats. It detects and blocks malicious codes by analyzing the behavior of the file that is transmitted from the web browser and communicating with the web server in the virtual system. Honeypots are classified as server-side honeypots and client-side honeypots depending on location. The server-side honeypot is a honeypot that waits for attacks by external attackers, while the client-side honeypot visits web sites through a crawler, collects web page codes and downloaded files, induces infection, and analyzes malicious behavior based on the collected information. Honeypots can also be classified into low-interaction client honeypots and high-interaction client honeypots. The former can operate in simple script form, so it does not require building a system, and it has the advantage of detecting known malicious behavior quickly. One such low-interaction client honey pot is Monkey-spider, which was developed by Mannheim University in Germany, which uses a Heritrix crawler to visit suspected URLs and detects malicious code by analyzing the source code of the downloaded website. However, low-interaction honeypots have a disadvantage in that they cannot analyze drive-by-download attacks. A high-interaction client honeypot can be used to build real-word systems to detect traffic on files that are downloaded after visiting a web site, monitor the movement of network traffic on path changes and the registry and file systems of a virtual environment, and monitor resource changes such as memory information. This type of honeypot has a disadvantage in that it takes time, because it performs analyses in greater detail than a low-interaction client honeypot. However, it can detect attacks that exploit vulnerabilities in application programs, because the system is implemented alone. For this reason, it is advantageous for the detection and prevention of unknown attacks.