# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Detection Techniques in Security Control Systems  
Security control systems can be categorized into firewall and web firewall, anti-virus, intrusion detection system, intrusion prevention system, network forensic, APT dedicated solution, log analysis system, honeypot, prevention of internal information leakage, secure USB, and spam mail protection system. The firewall technique controls malicious traffic by determining whether to allow or block traffic input and output to and from the network based on predefined policies and rules. The available traffic permission and block methods include the black list-based technique that defines policies and rules for malicious traffic as well as the white list-based technique that defines policies and rules for normal traffic. The black list-based technique blocks traffic that has occurred in the past or abnormal addresses and ports, and the white list-based technique allows only traffic that is input and output from the normal addresses and ports. Therefore, with properly defined policies and rules, this technique has the advantage of blocking attacks from inside and outside. However, it does not prevent attacks that do not have defined rules. If the wrong rules are set, then normal traffic will be blocked, and if many rules are defined to prevent various attacks, then the traffic processing performance will be degraded and loss will occur. Although the web firewall technique is similar to the firewall technique, it differs in that traffic is targeted to a web service, HTTP, HTTPS, FTP, etc., and the protection target is only web servers [11; 13]. Anti-virus software is software that protects systems from malware. The software analyzes malicious codes and defines characteristic parts of the codes, for example, a hash value of a specific string or file called a signature. If a particular string is found in the malicious code or has the same hash value, then that code is identified as malicious and its execution is blocked. Malicious programs are detected through comparisons of strings or hash values, which is advantageous in that inspection time is past. Nevertheless, there is a possibility of both false positive and false negative results. For example, in some cases, the same string and the same hash value are defined in a normal program, and it takes a lot of time to update the signature. In a case where an unknown new malicious code appears, there is no signature. Moreover, a variant in which the malicious code is changed will not be detected because the string or hash value has changed. Therefore, to overcome the problems of signature-based detection methods, software is currently being developed using heuristic-based detection methods and behavior-based detection methods [10; 13; 31; 32]. An IDS (Intrusion Detection System) detects intrusions in real time. This technique involves analyzing the principle and type of attacks and generating signatures, which is a characteristic for detecting the signature [33; 34; 35]. If the same signature is detected, then the attack is identified as an intrusion. However, this system involves certain disadvantages. For example, the system cannot obtain signatures for unknown attacks, multi-level packing and encryption make it difficult to detect signatures, it is difficult to detect obfuscated malicious code, and there is a need for periodic detection pattern management. An IDS may be classified as a network-based system or a host-based system depending on which system the detection is performed. Network-based systems detect signatures based on network traffic, and they provide network traffic monitoring and usage information capabilities, multi-level attack investigation capabilities, management capabilities for rapid response to