Apparatus and method for preventing anomaly of application program

1. An apparatus for preventing an anomaly of an application program executed in a computer, comprising:

a hardware processor;

a behavior profile database that stores a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for the each application program, information on behavior that is permitted to be executed by the respective application program in operation, and

wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior;

a behavior monitor that detects behavior of the application program in operation,

wherein the behavior monitor detects only behavior of a selected application program based on a monitoring-target program database storing a predetermined list of monitoring-target application programs, and

wherein the predetermined list is configured from a list of application program interface (API) functions;

an anomaly detector that determines whether the detected behavior of the application program is an anomaly based on the behavior profile of the application program stored in the behavior profile database,

wherein the anomaly is configured to be detected from at least a reliable application program,

wherein the reliable application program is configured to be a program trusted by a user to be executed in the computer of the user, and

wherein the anomaly is configured to determine that the detected behavior of the respective application program is different from the permitted behavior to be executed by the same respective application program; and

an anomaly stopper that stops the behavior of the application program determined as the anomaly by the anomaly detector.

2. The apparatus of claim 1 , further comprising:

a behavior profile extractor that extracts the behavior profile of the application program in operation.

3. The apparatus of claim 2 , wherein the behavior profile extractor extracts the behavior profile of the application program in operation by analyzing a source code of the application program in operation.

4. The apparatus of claim 2 , wherein the behavior profile extractor extracts the behavior profile of the application program in operation by simulating the application program in operation.

5. The apparatus of claim 1 , wherein the behavior profile is an extensible markup language (XML) code comprising a tag indicating whether each behavior is accepted.

6. The apparatus of claim 1 , wherein the behavior monitor detects only monitoring-target behavior among behavior of the application program in operation on the basis of types of monitoring-target behavior stored in a monitoring-target behavior database.

7. The apparatus of claim 1 , wherein the behavior monitor hooks and analyzes the respective (API) function called by the application program in operation using an API hooking module.

8. The apparatus of claim 7 , wherein the behavior monitor detects only monitoring-target behavior among behavior of the application program in operation based on a monitoring-target behavior database storing the list of API functions corresponding to a monitoring-target behavior.

9. A method for preventing an anomaly of an application program executed in a computer, comprising:

storing a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for each application, information on behavior that is permitted to be executed by the application,

wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior;

detecting behavior of the application program in operation, and

wherein the detecting of the behavior of the application program in operation comprises:

detecting only behavior of a selected application program based on a monitoring-target program database storing a predetermined list of monitoring-target application program, and

wherein the predetermined list less than an actual list of behaviors that are performed for each of the application programs;

determining by a processor whether the detected behavior of the application program is an anomaly based on the stored behavior profile of the application program,

wherein the anomaly is detected from at least a reliable application program, and

wherein the reliable application program is a program trusted by a user to be executed in the computer of the user,

wherein the reliable application program is trusted by the user prior to the detecting of the behavior of the application program in operation, and

wherein the anomaly determines that the detected behavior of the selected application program from the respective application program is different from the permitted behavior to be executed by the same respective application program; and

stopping the behavior of the application program determined as the anomaly, and

wherein the behavior is stopped in the application program before being executed in the computer.

10. The method of claim 9 , wherein in extracting the behavior profile of the application program in operation, the behavior profile is extracted by analyzing a source code of the application program in operation.

11. The method of claim 9 , wherein in extracting the behavior profile of the application program in operation, the behavior profile is extracted by simulating the application program in operation.

12. The method of claim 9 , wherein the detecting of the behavior of the application program in operation comprises:

hooking an API function called by the application program in operation; and

detecting the behavior attempted by the application program in operation by analyzing the hooked API function.

13. The method of claim 9 , wherein the detecting of the behavior of the application program in operation comprises:

detecting only monitoring-target behavior among behavior of the application program in operation based on types of monitoring-target behavior stored in a monitoring-target behavior database.

14. An apparatus for preventing an anomaly of an application program executed in a computer, comprising:

a hardware processor;

a behavior profile database that stores a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for each application, information on behavior that is permitted to be executed by the application program,

wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior,

wherein the behavior is configured to be a normal behavior of an application program in operation, and

wherein the normal behavior comprises no malicious codes, and

wherein the malicious codes comprises known malicious codes or unknown malicious code;

a behavior monitor that detects behavior of the application program in operation,

wherein the behavior monitor detects only behavior of a selected application program based on a monitoring-target program database storing a list of monitoring-target application programs, and

wherein the behavior monitor hooks and analyzes an application program interface (API) function called by the application program in operation using an API hooking module;

an anomaly detector that determines whether the detected behavior of the application program is an anomaly based on the behavior profile of the application program stored in the behavior profile database,

wherein the anomaly is configured to be detected from at least a reliable application program,

wherein the reliable application program is configured to be a program trusted by a user to be executed in the computer of the user, and

wherein the anomaly is only determined from the detected behavior from a predetermined number of selected application programs for each of the application programs; and

an anomaly stopper that stops the behavior of the application program determined as the anomaly by the anomaly detector, and

wherein the behavior is stopped in the application program before being executed in the computer.