Patent Document ID: 9621571
Application ID: 14788831
Patent Status: 1

Claim One:
1. A method for searching for similar malicious code based on malicious code feature information, comprising: registering, by a malicious code registration unit, input new malicious code as a new malicious code sample, and extracting and registering detailed information of the new malicious code sample; analyzing, by a malicious code analysis unit, the detailed information of the new malicious code sample; extracting, by a malicious code DNA extraction unit, malicious code DNA information including malicious code feature information, based on analyzed malicious code information; comparing, by a malicious code DNA comparison unit, the extracted malicious code DNA information with malicious code DNA information of prestored malicious code samples, for each DNA type, and then calculating similarities therebetween for each DNA type; and calculating, by a similar malicious code search unit, based on the similarities calculated in similarity calculation, all similarities between the new malicious code sample and the prestored malicious code samples, and extracting a specific number of malicious code samples as a result of searching for similar malicious code, wherein the malicious code feature information comprises Application Programming Interface call (APICALL) information, network information, IMPORT, EXPORT, Mutually exclusive (Mutex) and DROP files, file generation and open information, registry change information, string information, and function-based instruction sequence information.