Abstract: An apparatus for detecting a malware in files includes an acquisition unit configured to obtain from a file system information about a first time point when an interested folder is created by the file system, and information about a second time point when an interested file is created in the interested folder by the file system, a candidate determination unit configured to determine whether the interested file is a candidate file to be subjected to a malware inspection, based on the information on the first and the second time point, and an inspection unit configured to perform the malware inspection on the interested file determined to be the candidate file for the malware inspection.

Abstract: Disclosed is a method of protecting an input/output packet of a USB device. The method includes: a) registering a filter driver to a USB host controller within a system, and loading the filter driver; b) generating a first filter driver object (filter device object; FiDO), monitoring input/output packets of all USB devices by attaching the first filter driver object (FiDO) to a device object (functional device object; FDO) for the USB host controller; c) determining if there is an identifier in the input/output packet; d) when it is determined that there is the identifier in the input/output packet, registering a data protection routine in the input/output packet; e) copying the input/output packet from the data protection routine to a predetermined region, and exchanging the input/output packet with a predetermined value.