Apparatus and method for automatically analyzing program for detecting malicious codes triggered under specific event/context

Abstract

Provided is an apparatus for automatically analyzing a program in order to detect window malicious codes that are programmed to perform malicious behaviors only when a specific event occurs or when a specific program execution condition is satisfied. The automatic program analyzing apparatus includes an automatic analysis engine for analyzing statements in a program and generating program execution information by forcefully executing each statement in the program; an execution information database for storing the program execution information generated by the automatic analysis engine; an execution flow analyzer for analyzing execution flow of the program based on the execution information stored in the execution information database; and an execution result provider for providing a user with an execution result based on the execution flow information analyzed by the execution flow analyzer.

Dependencies are inferred from the claim text.