# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Behavior-Based Detection Method
Fourth, ciphertexts to which encoding methods such as Base64 are applied are limited in terms of detection, as the characteristics of ciphertexts disappear and entropy decreases. Fifth, false positives are to be found in compressed files in which features similar to those of ciphertexts appear. Finally, the application of partial encryption reduces entropy, which makes detection difficult, and there is a problem in that measuring the entropy of a pure file must precede each file format [97; 98]. To address these problems, [99] proposed a method for the automatic quantification of entropy in files, [95; 100] introduced a method for detecting entropy by dividing a file into multiple zones and a method for analyzing only the header of the file [95; 96; 99; 100; 101; 102; 103]. The integrity check technique checks the reliability of the data and executable files in a system. This method uses a hash function such as MD5 (Message Digest 5) to generate unique values for the executable files and folders of an uninfected system, then analyzes the behavior of malicious code by detecting changes in the values of existing files and folders or newly created files and folders by periodically comparing the eigenvalues. Therefore, when the eigenvalue of a file or folder is changed or not defined, the system and executed file are suspected of performing malicious actions. As a result, unknown new malicious codes can be detected. However, if the system is already infected, it is difficult to cope with and recover from the infection [10; 28; 83]. The behavior monitoring and blocking method monitors all activities that occur in a system, and blocks executable files by tracking the subject of the action when malicious actions occur. If a malicious action is detected, information about the file is displayed to the user, who can then decide whether or not to block the malicious action. In the case of a file executed by the user, the execution of the file is allowed to continue. Malicious code is detected and prevented by blocking the execution of files that are not executed by the user. In this method, malicious behaviors are determined based on API call processes and access objects, and studies have been conducted to compare the behavior graphs that are generated based on this information. The behavior monitoring and blocking method can be subdivided into the following categories: spear phishing email surveillance, frequency of occurrence of opcode sequence, common behavior graph showing malicious code execution behavior, framework based on machine learning methods, and association with registry and process information. [PERSON] proposed a spear phishing email surveillance method. This method combines the information contained in a social service profile with the information of an e-mail, including its title, contents, and attachments, to determine whether the e-mail is malicious, as e-mails represent one of the main paths through which malicious codes infect systems. This method detects spear phishing e-mails using various machine learning algorithms. Experimental results have shown that this method does not detect actual spear phishing e-mails, but it seems that such attempts are very helpful in detecting malicious codes. The frequency of occurrence of the opcode sequence method was proposed by [PERSON]. This method detects malicious codes by comparing the frequency of occurrence of opcodes based on the relevance and frequency of opcodes in a code sequence, which is based on how often a sequence appears. The common behavior graph showing the malicious code execution behavior method was proposed by [PERSON]. This method creates a KOBG (Kernel Object Behavior Graph), which is a behavior graph that represents kernel objects and attributes them the nature of malicious codes that invoke system calls for attack. Then, malicious behaviors are detected by comparing the graph generated from malicious codes with a weighted behavior graph. The framework based on the machine learning method was proposed by [PERSON].