# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Behavior-Based Detection Method
This method uses static analysis to represent malicious and benign executables. An association with registry and process information was proposed by [PERSON]. This method analyzes the behavior patterns by examining the time, calling process, function, and registry key based on the characteristics of the registry and process information that is accessed by the malicious codes to perform malicious behaviors [10; 28; 71; 76; 86; 89; 90; 104; 105]. The API call behavior detection method generates threat indicators that are used to calculate a risk index; malicious behaviors are detected by analyzing the behavior of programs and files based on the threat indicators, which serve as indicators of correlation analysis. These threat indicators can be classified into risk, warning, and safety stages. Programs are installed and executed in the safety stage, but they are blocked in the dangerous stage [11]. Visualizations can be classified into tree map-based, grayscale of binary content, function call graph, control flow graph, and behavior-dependent graph visualizations. [PERSON] proposed tree map-based visualization, which identifies malicious behavior and classifies malicious targets into processes, files, and registers. When the same behavior is detected by comparing tree maps, malicious code is detected [13; 106]. The grayscale-based visualization of binary content was proposed by [PERSON]. Binary contents that appear in malicious code are visualized as grayscale images, and malicious code is determined based on the degree of visual similarity [107; 108; 109]. A function call graph (FCG) is a graphical representation of functions contained within a program, which is a directional graph on which the edge indicates a function call. In addition, [PERSON] and [PERSON] recently proposed a malware detection method that extracts vectors from function-call graphs based on function clustering. A control flow graph (CFG) was proposed by [PERSON]. This method detects variant malware using a control flow graph [13; 110]. The behavior-dependent graph was proposed by [PERSON]. This method detects malicious codes by comparing existing behavior-dependent graphs with the behavior graph extracted from an incoming file. In another study, the traffic characteristic method was proposed by [PERSON]. This method defines the behaviors of traffic generated by malicious codes by detecting different parts of the traffic characteristics between benign traffic and malicious traffic [13; 111]. The abnormal behavior detection method generates a model of benign behavior, then determines malicious behaviors when observing actions that have not been included in the model. Data mining and statistical methods are used to generate models of benign behaviors [22; 112; 113]. The system call sequence state-based detection method analyzes benign behavior and abnormal behavior by examining the patterns of the correlation of states based on a sequence of system calls. This method defines a sequence of system calls that are called during a specific time period as a state, and it detects malicious codes based on patterns that indicate transitions of the classified state transitions. These can be divided into eight categories (file system, kernel, memory management, and so on) [22; 114]. The use of fuzzy logic and genetic algorithms was proposed by [PERSON]. This method detects abnormal behaviors by defining the actions of a benign user by applying fuzzy logic to system log files. It is possible to generate new user behavior rules by applying a genetic algorithm to optimize user behaviors [22; 115].