Method and apparatus for analyzing malicious code

A method of analyzing a function of a malicious code, the method comprising:

• obtaining a source code of a malicious file which is an object of analysis;
• generating, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;
• analyzing a dependency relationship between parameters by analyzing the nodes of the first graph;
• generating second graphs indicating the analyzed dependency relationship between the parameters;
• and
• analyzing the function of the malicious code by comparing a degree of similarity between each of pre-stored representative graphs and the generated second graphs.

A method of analyzing an evolutionary relationship of a malicious code, the method comprising:

• calculating a first degree of complexity of each of a plurality of malicious code binaries;
• selecting a root binary that is initially generated, by using the calculated first degree of complexity;
• and
• inferring an evolutionary order of the plurality of malicious code binaries, except for the root binary, based on the calculated first degree of complexity and a degree of distance between the plurality of malicious code binaries.

An apparatus for generating representative graphs for analyzing a function of a malicious code, the apparatus comprising:

• a memory storing one or more instructions;
• and
• one or more processors configured to execute the one or more instructions stored in the memory to:
• obtain a source code from a pre-stored malicious file;
• generate, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;
• analyze a dependency relationship between parameters by analyzing the nodes of the first graph;
• generate second graphs indicating the analyzed dependency relationship between the parameters;
• cluster the second graphs based on a degree of similarity;
• and
• generate the representative graphs representing functions of each of clusters of the clustered second graphs.

An apparatus for analyzing a function of a malicious code, the apparatus comprising:

• a memory storing one or more instructions;
• and
• one or more processors configured to execute the one or more instructions stored in the memory to:
• obtain a source code of a malicious file which is an object of analysis;
• generate, by analyzing the source code, a first graph in which each of nodes is formed of a portion of the source code;
• analyze a dependency relationship between parameters by analyzing the nodes of the first graph;
• generate second graphs indicating the analyzed dependency relationship between the parameters;
• and
• analyze the function of the malicious code by comparing a degree of similarity between each of pre-stored representative graphs and the generated second graphs.

An apparatus for analyzing an evolutionary relationship of a malicious code, the apparatus comprising:

• a memory storing one or more instructions;
• and
• one or more processors configured to execute the one or more instructions stored in the memory to:
• calculate a first degree of complexity of each of a plurality of malicious code binaries;
• select a root binary that is initially generated, by using the calculated first degree of complexity;
• and
• infer an evolutionary order of the plurality of malicious code binaries, except for the root binary, based on the calculated first degree of complexity and a degree of distance between the plurality of malicious code binaries.