Apparatus and method for preventing anomaly of application program

A method for preventing an anomaly of an application program executed in a computer, comprising:

• storing a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for each application, information on behavior that is permitted to be executed by the application,
• wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior;
• detecting behavior of the application program in operation, and
• wherein the detecting of the behavior of the application program in operation comprises:
• detecting only behavior of a selected application program based on a monitoring-target program database storing a predetermined list of monitoring-target application program, and
• wherein the predetermined list less than an actual list of behaviors that are performed for each of the application programs;
• determining by a processor whether the detected behavior of the application program is an anomaly based on the stored behavior profile of the application program,
• wherein the anomaly is detected from at least a reliable application program, and
• wherein the reliable application program is a program trusted by a user to be executed in the computer of the user,
• wherein the reliable application program is trusted by the user prior to the detecting of the behavior of the application program in operation, and
• wherein the anomaly determines that the detected behavior of the selected application program from the respective application program is different from the permitted behavior to be executed by the same respective application program;
• and
• stopping the behavior of the application program determined as the anomaly, and
• wherein the behavior is stopped in the application program before being executed in the computer.

An apparatus for preventing an anomaly of an application program executed in a computer, comprising:

• a hardware processor;
• a behavior profile database that stores a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for each application, information on behavior that is permitted to be executed by the application program,
• wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior,
• wherein the behavior is configured to be a normal behavior of an application program in operation, and
• wherein the normal behavior comprises no malicious codes, and
• wherein the malicious codes comprises known malicious codes or unknown malicious code;
• a behavior monitor that detects behavior of the application program in operation,
• wherein the behavior monitor detects only behavior of a selected application program based on a monitoring-target program database storing a list of monitoring-target application programs, and
• wherein the behavior monitor hooks and analyzes an application program interface (API) function called by the application program in operation using an API hooking module;
• an anomaly detector that determines whether the detected behavior of the application program is an anomaly based on the behavior profile of the application program stored in the behavior profile database,
• wherein the anomaly is configured to be detected from at least a reliable application program,
• wherein the reliable application program is configured to be a program trusted by a user to be executed in the computer of the user, and
• wherein the anomaly is only determined from the detected behavior from a predetermined number of selected application programs for each of the application programs;
• and
• an anomaly stopper that stops the behavior of the application program determined as the anomaly by the anomaly detector, and
• wherein the behavior is stopped in the application program before being executed in the computer.