Electronics and Telecommunications Research Institute

Yun Ju Kim

Young Tae Yun

Jae Woo Park

Dong Su Nam

Provided is an apparatus and method for detecting a malicious file that attempts to initiate communication in a mobile terminal without a user's approval. The method of detecting a malicious file in a mobile terminal includes: determining whether a file to be examined is an executable file; when the file is an executable file, examining whether the file is a malicious file that can cause unapproved communication based on at least one predetermined examination condition; and outputting the result of examining whether the file is the malicious file. Accordingly, an attack caused by a new type of malicious code can be coped with.

Apparatus and method for detecting malicious file in mobile terminal

Provided are an apparatus and method for detecting a malicious process. The apparatus includes: a process monitoring unit for monitoring a process generated in a computing environment; a target process setting unit for previously setting a test target process among the processes confirmed by the process monitoring unit; a process generation time change monitoring unit for monitoring if the target process set by the target process setting unit requests to change a generation time; a generation time change preventing unit for preventing a change in the generation time of the target process when the target process requests to change the generation time; and a malicious process detecting unit for determining that a child process of the target process set by the target process setting unit is a malicious process if the child process is generated within a predetermined reference time.

Growing community of inventors

Gyeonggi-do, South Korea

Yun Ju Kim