# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Heuristic-Based Detection Method  
The pattern-based detection method has the advantage of enabling fast detection because it only compares defined signatures. However, there is a problem in that it cannot detect new malicious code or variant malicious code without signatures. The heuristic-based detection method for detecting variant malicious codes and new malicious codes was developed to solve this problem. This method identifies specific behaviors of malicious code, and it aids in the detection of variant malicious codes because it judges actions without comparing signatures. The method used to identify specific behaviors involves collecting commands related to file, registry, network communication, and resource usage,then determining the behavior of these commands as a heuristic signature and comparing existing and variant malicious codes with known malicious codes. Through this comparison of similarities, the heuristic detection method detects malicious code with simple changes, such as modifications of several bytes. However, as it is difficult to define the criteria for the comparison, benign programs are often identified as malicious code. The heuristic detection method can be classified into static heuristic, dynamic heuristic, negative heuristic, and generic algorithm methods [10; 13; 28; 68; 69; 70; 71; 72; 73].  
The static heuristic detection method compares the heuristic signature of a file with a previously defined heuristic signature based on information in the file without having to execute the file [8; 11; 45; 46]. The dynamic heuristic detection method defines and compares various information and behaviors that occur when a file is executed; this method is also referred to as run-time heuristic detection because files are detected as they are executed. The files are executed in a virtualized area or an area separate from the operating system to protect the system from infection during the detection process [10; 13; 70; 71; 72].  
The negative heuristic detection method provides a way to define the heuristic signature of a benign file and allow for signature matching; this differs from the existing heuristic detection method of detecting and blocking malicious behavior. Since this is a whitelist-based detection method, it has the advantage of being able to detect new and variant malicious codes. However, it has a disadvantage in that malicious codes are detected as benign programs [28; 74].  
The generic algorithm-based method detects variants that are similar to malicious code that is already known. The degree of similarity is compared using a genetic algorithm based on instructions written in the code segment of a program; an opcode instruction comparison method is mainly used. This method can be classified as a wildcard or mismatch comparison method based on the means of comparison. The wildcard comparison method compares the degree of similarity by processing the wildcard portions of the opcode of a specific area while ignoring the portions that are changed. In this way, if malicious codes are slightly transformed or modified, it is possible to detect variant malicious codes because they have a high degree of similarity. Moreover, it is also advantageous in that there is no need for an update because an existing signature is used to compare the degree of similarity. However, when an obfuscation technique is used to prevent analysis of the instructions, a malicious code cannot be detected because the files do not appear similar, and the method cannot be used to detect a new (non-similar) malicious code. In recent years, Android malware detection methods applying genetic algorithms have mainly been studied, and [PERSON] verified a malware detection rate of about 98% with a combination of genetic algorithms and support vector machines [10; 28; 75; 76; 77; 78].