Patent ID: 8646076

Claim:
An apparatus for detecting malicious shell codes using a debugging event, the apparatus comprising: an alert setting unit configured to set a mother program for executing a non-executable file to trigger the debugging event when a mother process created by the mother program tries to execute a code with no execution attribute; an information storage unit configured to store information on an address range in which modules to be used by the mother process are loaded in a memory; a malicious code determination unit configured to determine whether the non-executable file is malicious using the information on the address range when the debugging event occurs; a cause analyzing unit configured to compare the module having the instruction related to the execution address out of the address range with information on vulnerabilities to analyze the reason for the vulnerability when it is determined that the non-executable file is malicious; and a malicious code extraction unit configured to extract the code in memory regions corresponding to the execution address out of the address range, wherein the alert setting unit injects a data execution alerting thread into a target process to be detected when the debugging event occurs by the mother process, and wherein the malicious code determination unit determines that the non-executable file is malicious when the execution address of the instruction executed by the mother process is out of the address range, determines whether the non-executable file is malicious depending on information about whether a SEH (Structured Exception Handling) is infected when the execution address of the instruction is within the address range, and determines that the structured exception handling is infected and the non-executable file is malicious when a current address of a chain value of the structured exception handling is the same as an address of a next structured exception handling.