Abstract: A code inspection interface providing method according to an embodiment of this disclosure includes providing a graphical user interface (GUI) for performing code inspection, executing an analysis routine on an inspection target code when the inspection target code is selected through the GUI, and providing the result of executing the analysis routine. The analysis routine may include an operation of extracting an abstract syntax tree includes a plurality of nodes from the inspection target code. A code inspection interface providing method is capable of providing an interface that can analyze a code and detect a security vulnerability in real time regardless of the language version of the code and an apparatus for implementing the method.

Abstract: A method for detecting vulnerability according to an embodiment includes performing taint analysis on a front-end source code generated with a first programming language of a program composed of the front-end source code and a back-end source code generated with a second programming language, generating a back-end call table including input parameter taint information for a called function called by the front-end source code among one or more back-end functions included in the back-end source code, based on a result of the taint analysis on the front-end source code, and performing taint analysis on the back-end source code based on the back-end call table.

Abstract: Provided is a method of detecting a NOP sled, which is performed by a computing apparatus. The method comprises determining, as a NOP sled characteristic value, a longest consecutive length of at least one of previously found NOP sled patterns, with respect to a plurality of tracking target memory blocks allocated in a memory of the computing apparatus and detecting whether or not a NOP sled occurs based on the NOP sled characteristic value of at least one of the plurality of tracking target memory blocks and a memory block length of the at least one of the plurality of tracking target memory blocks.

Abstract: Provided are an apparatus and method for detecting a malicious code. The method for detecting a malicious code includes detecting a call of one or more Application Program Interfaces (APIs) included in a monitoring group, acquiring a memory address of a caller of the detected call of the API, checking an attribute of a memory region corresponding to the acquired memory address, and determining whether a code written in the memory region is a malicious code based on the attribute.

Abstract: A proactive worm containment (PWC) solution for enterprises uses a sustained faster-than-normal outgoing connection rate to determine if a host is infected. Two novel white detection techniques are used to reduce false positives, including a vulnerability time window lemma to avoid false initial containment, and a relaxation analysis to uncontain (or unblock) those mistakenly contained (or blocked) hosts, if there are any. The system integrates seamlessly with existing signature-based or filter-based worm scan filtering solutions. Nevertheless, the invention is signature free and does not rely on worm signatures. Nor is it protocol specific, as the approach performs containment consistently over a large range of worm scan rates. It is not sensitive to worm scan rate and, being a network-level approach deployed on a host, the system requires no changes to the host's OS, applications, or hardware.

Abstract: A proactive worm containment (PWC) solution for enterprises uses a sustained faster-than-normal outgoing connection rate to determine if a host is infected. Two novel white detection techniques are used to reduce false positives, including a vulnerability time window lemma to avoid false initial containment, and a relaxation analysis to uncontain (or unblock) those mistakenly contained (or blocked) hosts, if there are any. The system integrates seamlessly with existing signature-based or filter-based worm scan filtering solutions. Nevertheless, the invention is signature free and does not rely on worm signatures. Nor is it protocol specific, as the approach performs containment consistently over a large range of worm scan rates. It is not sensitive to worm scan rate and, being a network-level approach deployed on a host, the system requires no changes to the host's OS, applications, or hardware.