Korea Electric Power Corporation

Yoo-Jin Kwon

Seong-Ho Ju

Yong-Hun Lim

Chung-Hyo Kim

Disclosed herein are an apparatus and method for detecting abnormal behavior in a main device and a terminal device, included in a control network, using a whitelist. The apparatus for detecting abnormal behavior includes an information collection unit for collecting system information about the main device and system information about the terminal device and a detection unit for detecting abnormal behavior in the main device and the terminal device by comparing a whitelist with system information that includes the system information about the main device and the system information about the terminal device, wherein the whitelist includes a process whitelist, a file whitelist, and a network whitelist.

Growing community of inventors

Daejeon, South Korea

Yoo-Jin Kwon