Abstract: An apparatus for generating a signature that reflects the similarity of a malware detection and classification system of the present invention includes a pre-processing unit configured to generate an input vector from input information, a classification unit configured to calculate a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model, and a signature generation unit configured to generate a signature of the malware in a form of a binary vector by quantizing the latent vector.

Abstract: Disclosed are an apparatus and a method for detecting whether an anomalous sentence having a context different from that of other sentences exists in a document. The apparatus for detecting a contextually-anomalous sentence in a document according to the present invention includes: a sentence encoder for encoding individual sentences constituting document data by means of a predetermined rule (function) to generate encoding vectors; a context embedder neural network for converting the generated encoding vector into embedding vectors corresponding thereto; and a context anomaly detector neural network for detecting whether an anomalous sentence exists in the converted document data.

Abstract: Provides an apparatus for detecting variants of malicious code based on neural network learning, a method therefor and a computer readable recording medium storing a program for performing the method. According to the present invention, one-dimensional binary data is converted into two-dimensional data without separate extraction of features, and deep learning is performed through a neural network having a nonlinear multilayered structure, such that the features of the malicious code and variants thereof may be extracted by performing the deep learning. Therefore, since no separate feature extraction or artificial effort by an expert is required, an analysis time is reduced, and variants of malicious code that cannot be captured by existing malicious code classification tools may be detected by performing the deep learning.

Abstract: An apparatus for generating a signature that reflects the similarity of a malware detection and classification system of the present invention includes a pre-processing unit configured to generate an input vector from input information, a classification unit configured to calculate a latent vector which indicates the similarity between at least one malware classification and the input vector by performing a plurality of computations to which learned weights of a plurality of layers are applied on the input vector through a deep neural network model, and a signature generation unit configured to generate a signature of the malware in a form of a binary vector by quantizing the latent vector.

Abstract: Disclosed are an apparatus and a method for detecting whether an anomalous sentence having a context different from that of other sentences exists in a document. The apparatus for detecting a contextually-anomalous sentence in a document according to the present invention includes: a sentence encoder for encoding individual sentences constituting document data by means of a predetermined rule (function) to generate encoding vectors; a context embedder neural network for converting the generated encoding vector into embedding vectors corresponding thereto; and a context anomaly detector neural network for detecting whether an anomalous sentence exists in the converted document data.

Abstract: Provides an apparatus for detecting variants of malicious code based on neural network learning, a method therefor and a computer readable recording medium storing a program for performing the method. According to the present invention, one-dimensional binary data is converted into two-dimensional data without separate extraction of features, and deep learning is performed through a neural network having a nonlinear multilayered structure, such that the features of the malicious code and variants thereof may be extracted by performing the deep learning. Therefore, since no separate feature extraction or artificial effort by an expert is required, an analysis time is reduced, and variants of malicious code that cannot be captured by existing malicious code classification tools may be detected by performing the deep learning.