System and method for detecting malware based on virtual host
AssigneeElectronics and Telecommunications Research Institute
InventorsYoung Han CHOI, Haksoo KIM, Deokjin KIM, JungMin KANG, HyungGeun OH, Kiwook SOHN
Life of this patent
Estimating the term…
Abstract
A system and method for detecting malware based on a virtual host are provided. The system for detecting malware based on a virtual host includes a terminal network behavior analysis server and a virtual host. The terminal network behavior analysis server extracts network behavior information by monitoring the network behavior of an actual host, and outputs the extracted the network behavior information. The virtual host detects malware corresponding to abnormal behavior in the actual host, by receiving the network behavior information and then performing corresponding behavior.
Claims15
A system for detecting malware based on a virtual host, comprising:
- a terminal network behavior analysis server configured to extract network behavior information by monitoring network behavior of an actual host, and to output the extracted the network behavior information;
- and
- a virtual host configured to detect malware corresponding to abnormal behavior in the actual host, by receiving the network behavior information and then performing corresponding behavior.
The system of claim I, wherein the virtual host synchronizes software installation information and version information thereof with software installation information and version information of the actual host in order to perform network behavior of the actual host in an identical manner.
A method of detecting malware based on a virtual host, comprising:
- extracting, by a terminal network behavior analysis server, network behavior information by monitoring network behavior of an actual host;
- transferring, by the terminal network behavior analysis server, the extracted the network behavior information to the virtual host;
- and
- detecting, by the virtual host, malware corresponding to abnormal behavior in the actual host, by receiving the network behavior information and then performing corresponding behavior.
Dependencies are inferred from the claim text.