1. An apparatus for detecting an intrusion code, the apparatus comprising: a processor: a set value input unit in which a set value differentiated for each group, comprising at least one computer, of a plurality of groups is input; an immune database generation unit which generates an immune database, differentiated for each group, based on the set value, under control of the processor; and an intrusion code determination unit which determines whether target data corresponds to an intrusion code, based on the immune database, wherein, in generating the immune database differentiated for each group, the immune database generation unit uses a same method comprising: generating random pool features of data based on a length of a group feature key, corresponding to a characteristic of a sequence of a code, and a random pool size; and comparing at least one resident code determined to be secure with the random pool features of data to generate the immune database comprising selected random pool features of data which are selected from among the random pool features of data, and wherein, in using the same method, the at least one resident code, the length of the group feature key and the random pool size are differentiated for each group.