Malware detection method, malware detection device, and recording medium

A malware detection device for a home network system including one or more home appliances that are connected to a home network and that include a target home appliance subjected to malware detection, the malware detection device comprising:

• a processor;
• and
• a memory, wherein when using the memory, the processor operates as
• a setting value obtainer that obtains a plurality of setting values including at least information indicating a device type and an operating state of the target home appliance;
• a model implementer that implements one model out of a plurality of models according to the plurality of setting values obtained by the setting value obtainer;
• a power consumption obtainer that obtains power consumption or current consumption of the target home appliance;
• malware determiner that determines whether the target home appliance is infected with malware based on the power consumption or the current consumption as obtained from the power consumption obtainer, wherein the target home appliance is infected with malware when the power consumption or the current consumption shows an active stable usage of power or current within a predetermined range when the target home appliance is in a stable state;
• and
• an outputter that outputs a value indicating whether the target home appliance is infected with malware, the value being obtained by inputting the power consumption or the current consumption into the one model.

A non-transitory computer-readable recording medium having recorded thereon a program for performing a malware detection method for a home network system including one or more home appliances that are connected to a home network and that include a target home appliance subject to malware detection, the program being for executing:

• obtaining a plurality of setting values including at least information indicating a device type and an operating state of the target home appliance;
• implementing one model out of a plurality of models according to the plurality of setting values obtained in the obtaining of the plurality of setting values;
• obtaining power consumption or current consumption of the target home appliance;
• executing the one model to determine whether the target home appliance is infected with malware based on the power consumption or the current consumption as obtained from the obtaining of the power consumption or the current consumption, wherein the target home appliance is infected with malware when the power consumption or the current consumption shows an active stable usage of power or current within a predetermined range when the target home appliance is in a stable state;
• and
• outputting a value indicating whether the target home appliance is infected with malware, the value being obtained by inputting the power consumption or the current consumption into the one model.