Methods of identifying activex control distribution site, detecting security vulnerability in activex control and immunizing the same

A method of detecting a security vulnerability in an ActiveX control, comprising:

• installing an ActiveX control to be tested from a security vulnerability detection server to a testing PC that operates in a virtual machine;
• generating combinations of test input values for testing the ActiveX control;
• generating a test web page using the generated combinations of test input values;
• executing a web browser to access the generated test web page, monitoring activities of the web browser, and recording a debugging log caused by abnormal termination of the web browser and a resource access log caused by a resource access in a security vulnerability DB;
• and
• detecting a security vulnerability in the ActiveX control based on the security vulnerability DB.

A method of immunizing a security vulnerability in an ActiveX control, comprising:

• updating an exploit pattern DB in which an exploit pattern that is an abnormal use pattern of an ActiveX control at a user PC is recorded, and hooking a function call path of an ActiveX control to be monitored;
• monitoring a call of a function of the ActiveX control to be monitored using the hooked code;
• measuring a degree of similarity between a transfer factor and the exploit pattern with respect to each function call when the function call of the ActiveX control to be monitored is made;
• determining use of the exploit pattern and interrupting the function call when the measured degree of similarity exceeds a predefined threshold, and determining non-use of the exploit pattern and allowing the function call when the measured degree of similarity does not exceed a predefined threshold;
• and
• collecting information on abuse of a vulnerability and transferring the collected information to a security vulnerability detection server when the use of the exploit pattern causes the function call to be blocked.