METHOD FOR CLASSIFYING MALICIOUS CODE BY USING SEQUENCE OF FUNCTIONS' EXECUTION AND DEVICE USING THE SAME

摘要

The present invention relates to a method for classifying a malicious code using a function execution sequence, which is to rapidly search for malicious features of a malicious code; and an apparatus using the same. The method of the present invention comprises: a step (a) of acquiring a first sequence; a step (b) of determining a similarity between the first sequence and a second sequence; and a step (c) of classifying, by an apparatus, an unconfirmed code into a separate check object when the similarity is determined to be less than a first threshold value.