Abstract: Disclosed is a method of detecting anomalies suspected of an attack based on time series statistics according to the present invention. The method of detecting anomalies suspected of an attack according to the present invention includes the steps of: collecting log data and traffic data in real-time and extracting at least one piece of preset traffic feature information from the collected log data and traffic data; and training through a time series analysis-based normal traffic training model using the extracted traffic feature information, and detecting abnormal network traffic according to a result of the training.

Abstract: A system for analyzing large-scale malicious codes includes a malicious code management server dividing suspected malicious traffic collected into a plurality of first suspected malicious executable files and transmitting the plurality of first suspected malicious executable files to at least one or more virtualization analysis servers; and the at least one or more virtualization analysis servers executing the plurality of first suspected malicious executable files through a plurality of virtualization analysis agents load-balanced correspondingly to the plurality of first suspected malicious executable files and extracting first API call information called by malicious codes in user level and in kernel level.

Abstract: A system for detecting malicious codes based on API includes: a malicious code management server storing first suspected malicious executable files extracted from traffic to be analyzed collected or inputted; and a virtualization analysis server executing the first suspected malicious executable files received from the malicious code management server, extracting first API call information called by malicious codes in user level and in kernel level, and transmitting the extracted first API call information to the malicious code management server.

Abstract: Hypervisor-based intrusion prevention platform is provided. The hypervisor-based intrusion prevention platform comprises a virtual network intrusion prevention system (vIPS) framework which obtains internal information of a virtualization system from a hypervisor and performs security control on the hypervisor in response to the result of intrusion detection carried out by using the internal information of the virtualization system, a hypervisor security application programming interface (API) module which provides an API used by the vIPS framework to access the hypervisor, an administrator account management and authentication module which manages an administrator account of a vIPS and authenticates the administrator account, an environment setting management module which manages environment setting values of modules within the vIPS, and an external interface module which provides an interface for system control and security control.