# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Pattern-Based Detection Method  
Pattern-based detection methods have emerged because of the need to quickly inspect and analyze malicious codes coming from the outside. These methods detect and block a malicious code that matches patterns when the characteristics of known malicious codes are defined as specific patterns. They can be classified into signature-based detection, misuse detection, and malicious URL and IP detection according to the defined pattern. The signature-based detection method detects malicious codes that match the characteristics of previously analyzed malicious codes with specific signatures. Depending on the type of signature, this method can be categorized into string signature, command frequency signature, control flow graph (CFG) signature, byte sequence signature, opcode occurrence frequency, and sequence signature techniques. The string signature uses ASCII code and Unicode as signatures in a file, and it defines a specific signature based on a string stored in the DLL file name, API name, data section, and text section. The command frequency signature uses the frequency of occurrence of commands found in existing malicious codes as a signature and defines the statistical distribution of the commands as a signature. However, its utility is limited by the amount of experimental data that are available. The control flow graph (CFG) signature represents the execution flow and structure of the code appearing in the code section of a file as a CFG graph and also uses it as a signature. A block is used to divide the sequence of the assembly code in the code section based on the branch instruction, and the technique recognizesa graph that appears as a vertex. The byte sequence signature generates sequences of bytes stored in a file and defines it as a signature. The N-gram technique is mainly used for this purpose. This technique defines the length of a byte sequence as N and then slides N sequences of each file for comparison. The opcode occurrence frequency and sequence signature are weighted based on the occurrence frequency of opcode in a suspicious file; an opcode with no significance and low weight by noise is removed, and malicious code is detected by using the cosine similarity based on the opcode sequence represented by the vector and frequency. As detailed above, these signature-based detection methods are advantageous in that they can quickly analyze and detect malicious codes by matching suspicious codes with similar portions of defined signatures. To elaborate, these methods are able to detect malicious codes very effectively, along with 50% of unknown malicious codes. Moreover, malicious codes which have been circulated in small quantities or with a special purpose are 20% detectable by Gartner, because more than 90% of the files that come into the network are conventional benign files and malicious code [12; 13; 22; 28; 55; 56; 57; 58; 59; 60; 61; 62]. However, the signature method cannot detect unknown new malicious code due to the absence of a signature. This is because the signature method generates signatures based on the characteristics of the analysis results of the malicious code. Moreover, this method requires a lot of time to analyze malicious codes, along with more time to define and update the signature. Moreover, malicious codes that use zero-day vulnerabilities cannot be detected, and they are therefore difficult to respond to quickly [12; 13; 22; 26; 28; 55; 56; 57; 58; 59; 60; 61; 63; 64; 65]. Misuse detection is a method of detecting patterns corresponding to malicious code and malicious behavior that have already been detected, and this is accomplished by defining behavior rules and signatures as policies. This technique includes the signature analysis, expert system, state transition analysis, and Petri Net methods, and it has the advantages of a high detection rate and a fast detection speed, because malicious code is detected based on defined rules.