# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Virtualization-Based Detection Method  
The behavior-based detection method detects malicious behaviors involving target files, such as executable files and document files. However, the system can be infected in this process because it involves executing the file on the actual system. To solve this problem, it is necessary to create an environment that is separate from the system in which malicious behaviors can be analyzed in a safe space. A virtualization-based detection method has emerged to accomplish this. This method is closely related to the dynamic heuristic detection method. The virtualization-based detection method tracks malicious behaviors by monitoring the behavioral changes that occur when a file is executed in the same manner as the behavior-based detection method. The main difference is that it runs in an environment that is physically and logically isolated from the actual system. In this way, it is possible to protect the system from actions caused by untrusted programs, and the system is neither infected by malicious codes nor propagates such codes to the outside. Therefore, the characteristics of this method are very similar to those of the behavior-based detection method. However, the two differ because the former method makes it possible to construct a virtual space in an actual system to obtain execution and control information and to examine executable files. Moreover, a study was conducted in parallel with static analysis to achieve more reliable detection. Specifically, the tint analysis method, which analyzes the flow and purpose of data used in the process of execution by inserting the code to be analyzed in the middle of the execution code, was used instead of simply analyzing the code flow and behavior. This method is classified into an emulator and a sandbox method depending on how the virtual environment is constructed [10; 13; 28; 85; 86; 116; 117; 118; 119; 120; 121]. The emulator, which is an alternate launcher, is used to indirectly execute a file via virtual hardware based on a virtual environment and a virtual hardware image; this is also referred to as code emulation or CPU emulation. This method is advantageous in that the actual system is not affected, and the method can effectively detect unknown malicious codes due to the above characteristics [10; 86]. This method analyzes the behavior that occurs when the file is executed based on the emulation controller that controls the virtual environment supporting the CPU and memory in the system. The emulator creates a virtual space, but the sandbox collects information by running the file on the real system and detects malicious behaviors by monitoring information related to the activities of a process, a file, and a network. This method leaves the system vulnerable to infection by malicious codes because it involves executing the file in the actual system. Nevertheless, the system is not practically compromised by infection because the calling process is controlled by a specific tool. Representative products and systems include CWSandbox, Norman Sandbox, and Anubis. CWSandbox injects VMMonitor.dll, a monitoring module, into the thread of the file to be executed, then traces all of the procedures that are executed in the module and passes this information to CWSandbox. Accordingly, CWSandbox prevents the system from being infected by transmitting a benign return value to the operating system if the code is benign. Any malicious code that is detected is instead filtered. Despite these advantages, attackers have created new malicious codes to prevent detection in a virtualized environment, while sandbox services based on free and open-source software, such as CWSandbox, Zerowine, and Cuckoo Sandbox, have become more generalized. Hence, the defender cannot cope with this problem.