• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.5
• /
• pp.189-194
• /
• 2009

Most of anti-virus programs detect and compare the signature of the malicious code to detect buffer overflow malicious code. Therefore most of anti-virus programs can't detect new or unknown malicious code. This paper introduces a new way to detect malicious code traces memory executable of essentials APIs by malicious code. To prove the usefulness of the technology, 7 sample codes were chosen for compared with other methods of 8 anti-virus programs. Through the simulation, It turns out that other anti-virus programs could detect only a limited portion of the code, because they were implemented just for detecting not heap areas but stack areas. But in other hand, I was able to confirm that the proposed technology is capable to detect the malicious code.