 |
In the case of malicious code, the method suggested in this paper shows the same or similar character string. First, in a normal program, the string is defined as WhiteList, and the string extracted from the malicious code is defined as BlackList. The method of checking the entire file is to search the sub-directory using Java recursion to find the file.
After the searched file was changed to a binary string in the Java library, normal/abnormal classification processing was performed by comparing the strings of normal programs. During the second inspection after the first inspection during the program inspection, the normal/abnormal classification processing is performed only for the modified program, thereby eliminating unnecessary time for processing files without content changes. |
IEEE/ICACT20210176 Slide.11
[Big Slide]