# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Behavior-Based Detection Method  
The signature-based, heuristic-based, and reputation-based detection methods aim for malicious code detection. However, to apply these methods, information such as required signatures must be analyzed by malicious code analysts. There are also limitations to the ability of these methods to collect or analyze malicious code when the number of malicious codes increases, and when the speed at which malicious code is manufactured is much faster than the speed of analysis. It is also hard to analyze malicious codes realistically, because certain techniques are used to disturb the analysis of malicious code. Therefore, researchers have begun to analyze malicious behavior rather than analyzing the malicious file itself. The behavior-based detection method is a technique for detecting malicious behavior that occurs at the moment a file is executed. It represents an improvement upon the heuristic-based detection method. Malicious behavior occurs not only in executable files, but also in document files such as PDF, DOC, and HWP. The method determines the characteristics of malicious behavior according to files, registries, networks, and processes. Some examples of suspicious behavior include: when a DLL file and an.exe file are generated in a specific folder, such as a temporary folder that is not generated by a benign file; when a registry is registered for a specific service or a registry key value is altered to register startup programs; when a connection to a specific network is attempted; and when an executable file is executed to generate itself or an uncommon program such as a system program is executed. Thus, the detection of malicious activity can overcome the limitations of existing signature-based, heuristic-based, and reputation-based detection methods to detect new malicious code. Moreover, this method can use behavior to detect code variants and aid in deriving the necessary information that must be applied to existing detection methods. This is because an analyst can identify features such as the information and purpose of a malicious code, as well as its operation process in the system and propagation path. However, false negative and false positive results may be obtained as a result of irregular behavior from benign users, the use of avoidance techniques to disrupt the analysis, and the difficulty of detecting and responding at the kernel level. This method can be classified into static, dynamic, and hybrid analysis methods according to the specific type of analysis that is applied. Static analysis is used to analyze behavior via reverse engineering using a disassembler and decompiler without the need for actual execution of the file, and to analyze the overall structure and flow of the code by examining the consistency of the code's component and call relationships. For such an analysis, when using a Windows operating system, a PE (Portable Executable) structure--which is an executable file format--is used to extract the elements of each section, and then the results are derived. To derive the information of the calling functions, the defender analyzes the flow of the operation and determines malicious behavior by tracking the control flow of blocks, which are API (Application Programming Interface) information analysis included in the IAT (Import Address Table); extracting strings; and dividing the code into smaller units. This method does not affect the analytical system, because it does not directly execute the file, and it is possible to analyze the structure and operation flow without being affected by the condition that the malicious code executes. However, there are problems with this method. For example, automation is troublesome because much of the analysis is manual, and it is therefore time- and labor-intensive; further, the analysis is difficult when a file is encrypted and packed. Dynamic analysis is a method of analyzing the characteristics that appear when a file is actually executed.