Abstract: A method of training a malicious code detection model and a method of detecting a malicious code. The method includes acquiring application programming interface (API) call information of called functions from a result log of performing dynamic analysis of a malicious code, calculating time intervals between timestamps using the timestamps which indicate API call times extracted from the API call information, determining a feature value of the malicious code on the basis of the time intervals, and training the malicious code detection model using an API call sequence included in the API call information and the feature value.

Abstract: A method of training a malicious code detection model and a method of detecting a malicious code. The method includes acquiring application programming interface (API) call information of called functions from a result log of performing dynamic analysis of a malicious code, calculating time intervals between timestamps using the timestamps which indicate API call times extracted from the API call information, determining a feature value of the malicious code on the basis of the time intervals, and training the malicious code detection model using an API call sequence included in the API call information and the feature value.

Abstract: A method for generating a summary of URL (Uniform Resource Locator) according to an aspect of the inventive concept is performed by a computer device. The method may include obtaining a URL, parsing the URL to extract fields from the URL, generating attribute information indicating characteristics of each field for the fields, and generating a summary of the URL using the attribute information. A summary of an URL may be generated by reflecting structural characteristics of the URL, and the summary may be provided to URL clustering. Therefore, URL clustering in which the structural characteristics of the URL are fully reflected becomes possible. Furthermore, unlike existing machine learning-based clustering, a URL summary is generated based on rules and applied to URL clustering. Therefore, an operation time required for URL summarization or clustering is short, and it is possible to immediately reflect new data.