# Classification and Analysis of Malicious Code Detection Techniques Based on the APT Attack
## 5 Classification and Analysis of Malicious Code Detection Methods
### Analysis of Advantages and Disadvantages of Malicious Code Detection Methods  
Based on the results of the above analysis, we compare and analyze the advantages and disadvantages of different malicious code detection methods; the results are presented in Table 4. The O, \(\Delta\), and X symbols indicate whether malicious code types--such as analyzed malicious code, new malicious code, and variable malicious code and packing or encryption--can be detected by each malicious code detection method (the O symbol means it is detectable, X is not detectable, and \(\Delta\) is detectable, but depending on the data, the detection accuracy is relatively low or difficult).  
We find that most detection methods cannot detect packed or encrypted malicious code. The behavior-based detection method requires unpacking and decryption. All detection methods detect known malicious codes. However, the pattern-based detection method cannot detect new malicious codes and variant malicious codes, because it is based on patterns that have already been found in known malicious codes. The heuristic-based detection method also has a limitation in that it cannot detect new malicious codes, as is the case with the pattern-based detection method. The reputation-based detection method and the big data-based detection method (two data analysis-based methods) cannot detect new malicious codes and variant malicious codes either. This is because the reputation-based detection method identifies malicious code based on the reputation collected from users. For this reason, if incorrect reputation information is included, then this method will not be able to detect new malicious codes. The big data-based detection method and machine learning-based detection method (two data analysis-based methods) rely on the data used for learning. For this reason, detection is difficult when there is insufficient data or when features cannot be extracted to detect new malicious codes. In terms of detection rate, the pattern-based detection method, heuristic-based detection method, and reputation-based detection method are all fast, because they simply compare specific patterns. Meanwhile, the conventional behavior-based, visualization-based, anomalous symptom, big data-based, and machine learning-based detection methods are slower. This is because the behavior-based detection method and anomalous symptom detection method require time to determine malicious behavior, while the big data-based detection method requires time for learning. The various detection methods differ in terms of detection rate and false negative and false positive rates because of the different characteristics of each method. In particular, among the detection methods based on data analysis, the machine learning-based detection method has more severe deviations in detection rate due to false positive and false negative results depending on the quantity and quality of training data, and it requires a large amount of information and time for initial learning. However, when the initial learning is completed, this method has a very fast detection speed and detects known, new, and variant malicious codes, and it can be applied to detect all kinds of malicious codes, such as through pattern, behavior, visualization, reputation, and anomalous symptom analysis.