Patent ID: 8813229

Claim:
An apparatus for protecting an agent system from malicious code, the apparatus comprising: a database configured to have files which were existent in the agent system, digital file fingerprint values of a plurality of parts in each of the files, and index information indicating whether said each of the files is normal or malicious; a calculation unit configured to calculate a digital file fingerprint value of a first part in an executable file accessed by the agent system based on an execution order of executable codes in the executable file; a file inspection unit configured to perform: searching the database to extract a group of files having the same digital file fingerprint values as the digital file fingerprint value calculated by the calculation unit, blocking execution of the executable file when the calculated digital file fingerprint value of the executable file does not match with the digital file fingerprint value of at least one file in the database, inspecting the executable file to determine whether the executable file is normal or malicious based on the index information of each file within the group of files, allowing execution of the executable file when the executable file is determined to be normal, otherwise, making a request for the calculation of a digital file fingerprint value of a second part in the executable file, wherein the second part comprises the first part and an additional part in the executable file so that a size of the second part is larger than a size of the first part.