# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Reputation-Based Detection Method  
To address the issues inherent to the signature-based detection method (i.e., the inability to detect variant and new malicious codes), user information such as suspicious files, behavior patterns, and characteristics was collected, and a reputation-based detection method that compares these data to an existing signature database was developed. The main goal of this method is to detect new malicious code. It uses feedback from a large number of users to determine the reliability of new files. The reputation information is defined in terms of the number of users and producers, etc., and the accuracy and reliability are determined according to whether or not reputation information is successfully obtained and analyzed. During the detection process, when a new file is found in the system, this method creates a unique value for the file using a hash function and transmits it to the server to inquire whether it is malicious. If it is malicious, a neutralization code is returned. When the eigenvalue of the new file is not retained, maliciousness is determined by behavior analysis, dynamic analysis, and malicious URL analysis of the transferred file, and the above process is executed based on the obtained result. It is therefore possible to detect malicious code quickly when a unique value is defined and stored. Therefore, when a new malicious code appears, it is identified instantly, and its reliability is judged according to its reputation, thus providing an improved detection method. However, this method has some problems. For example, an agent program must be installed in the system to collect reputation information; the method cannot be applied to detection technology that analyzes network traffic because the detection is carried out by considering files. Further, this method must be combined with other existing detection methods, such as signature-based and heuristic-based detection methods, to determine whether or not certain information is malicious because the method relies solely on reputation information. Further, due to the increasing number of applications and web browser plugins, this method cannot cope with various dynamic threats such as combinations of different types of vulnerability and the first emergence of an unknown malicious code. This reputation-based detection method can be classified into reputation-based detection and behavior-based detection methods [12; 13; 79]. The behavior-based detection method detects malicious behavior based on detailed information such as stack and context when a real action is performed instead of a single action. To overcome the problems of both false negatives and false positives, this method is often combined with the reputation-based method. This method detects malicious code that exploits vulnerabilities in document files such as HWP and PDF, as well as executable files, because detection is based on behavior. It also detects malicious codes that utilize web browser vulnerabilities, system patch files such as ws2 help.dll, autorun commands that are propagated via USB, droppers, and other malicious codes that damage target systems. Further, when an unidentified process is found to be writing to the MBR area, writing to the root of the disk drive, or causing serious problems to the system such as by writing a host file, this method provides a function to confirm that the user is performing a requested behavior [12]. The reputation-based detection method defines the reputation information of a file based on the date of first discovery, the number of users, and the number of suspicious actions. When new files and processes are executed, this information is used to verify the reputation scores, and the user is warmed about files and processes with low reputation scores. On the other hand, files and processes with high reputation scores are considered to be trusted and thus allowed to execute. In some cases, reputation scores are computed based on suspicious behavior.