Electronics and Telecommunications Research Institute

Seung-Hyun Paek

Cheolho Lee

Ki Wook Sohn

Eun Young Lee

InSung Park

HyungGeun Oh

JooBeom Yun

DoHoon Lee

Provided are an apparatus and method for forecasting the security threat level of a network. The apparatus includes: a security data collection unit for collecting traffic data and intrusion detection data transmitted from an external network to a managed network; a malicious code data collection unit for collecting malicious code data transmitted from a security enterprise network; a time series data transformation unit for transforming the data collected by the security data collection unit into time series data; a network traffic analysis unit for analyzing traffic distribution of the managed network using the data collected by the security data collection unit; and a security forecast engine for forecasting security data of the managed network using the time series data obtained by the time data transformation unit, the data analyzed by the network traffic analysis unit, and the data collected by the malicious code data collection unit.

Apparatus and method for forecasting security threat level of network

Provided are a pattern analyzing/detecting method and a system using the same that are capable of detecting and effectively preventing an unknown malicious code attack. To detect such an attack, the method monitors the system to combine all behaviors exhibited within the system due to corresponding malicious codes, reprocess and learn the behaviors, analyze existing malicious behavior feature values (prediction patterns), and compare them with a behavior pattern exhibited by an execution code.

System and method of detecting anomaly malicious code by using process behavior prediction technique

Growing community of inventors

Daejeon, South Korea

Seung-Hyun Paek