Apparatus for detecting variants of malicious code based on neural network learning, method therefor and computer readable recording medium storing program for performing the method

A method for detecting variants of malicious code using a neural network comprising an input layer which includes a two-dimensional matrix of which one element is a unit of data processing, a hidden layer which includes a plurality of layers including a plurality of operations, wherein any one of operation results of any one of the plurality of layers is provided to and used in an operation of a subsequent layer as an input by giving weights, and an output layer which includes a plurality of nodes, the method for detecting variants of malicious code comprising:

• when input data including one-dimensional binary codes is input, by the data conversion unit, generating pixels by dividing the one-dimensional binary codes into pixel units, and converting the binary codes of the data into an image having the same ratio as a row-column ratio of the matrix using the generated pixels;
• and
• when the data is suspicious data, by the detection unit, providing the data converted by the data conversion unit to the neural network as an input of the suspicious data, extracting features of the malicious code through the neural network, and detecting a category of the malicious code included in the suspicious data according to the features of the malicious code.