US 2012/0233692 A1 · APPARATUS AND METHOD FOR DETECTING MALICIOUS SITES

Abstract

The invention relates to an apparatus for detecting malicious sites, comprising: a monitoring unit for monitoring all processes being executed in a computing apparatus; a hook code insertion unit for inserting a hook code in a process executed in a browser when the execution of the browser is detected by the monitoring unit; a danger level determining unit that, upon the detection of a website movement, uses the hook code to inspect a stack structure of a process implemented according to the website movement and determine whether or not to perform the stack structure inspection, and determines whether or not the website to which the movement has been made is a malicious site; and a database for storing a list of sites determined to be malicious.

Claims13

Dependent claims

An apparatus for detecting malicious sites, the apparatus comprising:

a monitoring unit configured to monitor all processes executed in a computing apparatus;
a hook code insertion unit configured to insert a hook code into a process executed by a browser when the execution of the browser is detected by the monitoring unit;
a danger level determining unit that, upon detection of a website movement, inspects a stack structure of a process created by the website movement using the hook code, checks whether or not the stack structure inspection has been done, and determines whether or not the website to which the movement has been made is a malicious site;
and
a database for storing the website determined to be malicious in a malicious site list.

2 more elements

A method for detecting malicious sites, the method comprising:

upon detection of execution of a browser while monitoring all processes executed in a computing apparatus, inserting a hook code into a process executed by the browser;
upon detection of a website movement, inspecting a stack structure of a process created according to the website movement by using the hook code;
checking whether or not the stack structure inspection has been made, and determining whether or not the website to which the movement has been made is a malicious site;
and
storing the website determined as the malicious site in a database.

2 more elements

Dependencies are inferred from the claim text.

Apparatus and method for detecting malicious sites

Life of this patent

Apparatus and method for detecting malicious sites

Life of this patent

Abstract

Claims13