Electronics and Telecommunications Research Institute

In Sook Jang

Jung Sun Kim

Do Hoon Lee

Hyung Geun Oh

Eun Young Lee

Sang Rok Lee

Jung Min Kang

Cheol Ho Lee

An apparatus and method for blocking the activity of malware are disclosed. The apparatus for blocking the activity of malware includes a storage unit, a posting unit, and a control unit. The storage unit stores an automatic execution permission list and a set security level. The posting unit posts a predetermined control time immediately after user terminal booting and a predetermined control time immediately after user login. The control unit permits or blocks the execution of an execution attempt file for the predetermined control time immediately after the booting and the predetermined control time immediately after the user login based on the automatic execution permission list and the set security level.

Apparatus and method for blocking activity of malware

An apparatus and method for preventing an anomaly of an application program are provided. More particularly, an apparatus and method for preventing an anomaly of an application program that detect and stop an anomaly on the basis of a behavior profile for an application program are provided. The apparatus includes a behavior monitor that detects behavior of an application program in operation, an anomaly detector that determines whether the detected behavior of the application program is an anomaly on the basis of a behavior profile of the application program in operation, and an anomaly stopper that stops the behavior of the application program determined as an anomaly by the anomaly detector. Possible application program behavior is stored according to its purpose in a behavior profile and an anomaly is detected and stopped on the basis of the behavior profile, thereby decreasing a false-positive rate of anomaly detection and simultaneously solving a problem of a conventional security programs being incapable of defending against attacks using the authority of a program trusted by a user.

Apparatus and method for preventing anomaly of application program

Growing community of inventors

Daejeon, South Korea

In Sook Jang