Patent Document ID: 8448248
Application ID: 12056236
Patent Flag: 1

Claim One:
1. An apparatus configured to execute program instructions for repairing a computer system infected by malware, the apparatus comprising: a receiving unit configured to receive a first behavior vector characterizing at least one operational function behavior of the malware from a malware control server; a determination unit configured to determine whether a diagnostic target program corresponds to malware based on the received first behavior vector and a second behavior vector characterizing at least one operational function behavior of the diagnostic target program; and a repair unit configured to repair the computer system based on a result of the determination, and a correlation determination unit wherein the determination unit comprises: a system use information storage unit configured to store a plurality of system use information of the diagnostic target program using a resource of the computer system; an operational function generation unit configured to generate one or more operational functions related to the diagnostic target program based on a correlation between the stored system use information; and an encoding unit configured to generate the second behavior vector by encoding the generated one or more operational functions, and the correlation determination unit configured to determine a correlation between the one or more operational functions, the encoding unit generates the second behavior vector when the one or more operational functions having the correlation, wherein the one or more operational functions comprise first operational function and a second operational function, and when the second operational function loads a file generated or modified by the first operational function the second operational function is called based on an execution result of the first operational function or the second operational function is called within a predetermined time duration after the first operational function is called, the encoding unit determines that the first operational function and the second operational function are correlated.