Abstract: Provided is an apparatus for detecting and classifying malicious code. The malicious code detection and classification apparatus comprise a graph-generating unit configured to generate graph information from source data including a plurality of nodes corresponding to APIs included in the source data and one or more edges connecting between the plurality of nodes; a matrix-generating unit configured to generate an adjacency matrix between the APIs included in the source data using the graph information; and a machine-learning unit configured to detect malicious code included in the source data using the adjacency matrix as an input value for a machine-learning-based analysis model.