Patent Document ID: 8245295
Application ID: 12099649
Patent Status: 1

Claim One:
1. An apparatus for diagnosing malicious code, the apparatus comprising: a behavior vector generation unit configured to generate a first behavior vector based on a behavior signature extracted from a diagnostic target program; a diagnostic data storage unit configured to store a plurality of second behavior vectors for a plurality of sample programs predetermined to be malicious a code diagnostic unit configured to diagnose whether the diagnostic target program is a malicious code by comparing the first behavior vector with the plurality of second behavior vectors wherein the code diagnostic unit comprises: a distance calculation unit configured to calculate and compare each distance between the first behavior vector and the plurality of second behavior vectors; and a code determination unit configured to divide a vector space into a normal behavior vector space and a malicious behavior vector space, the vector space including the first behavior vector and the plurality of second behavior vectors, to determine whether the first behavior vector is located in the malicious behavior vector space, and to determine that the diagnostic target program is a malicious code when the first behavior vector is included in the malicious behavior vector space.