Universal vulnerability detection method and system based on script virtual machine

Abstract

The invention discloses a universal vulnerability detection method based on a script virtual machine, which comprises the following steps of: analyzing a web page file, and obtaining all JS (Java script) script programs contained in the web page file; taking all the JS script programs as input for forming a word linked list; taking the word linked list as the input, and using the script virtual machine to implement the JS script programs in the word linked list; and detecting whether malicious codes are contained in the JS script programs or not and whether the JS script programs utilize known vulnerabilities or not during the process of implementing the JS scrip programs. The invention further discloses a universal vulnerability detection device based on the script virtual machine, which can greatly improve the detection rate of known vulnerability scripts, has great universal identification effect for 0day and the unknown vulnerabilities, and can provide fast support for capturing the unknown vulnerabilities immediately.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a general detection method and system for loopholes based on a script virtual machine. Background technique [0002] As web page Trojan horse scripts are exploited according to script vulnerabilities to become the mainstream means of Internet virus transmission, the number of attack scripts using browser and system vulnerabilities continues to increase. Due to the change of a string and encryption, it will produce completely different binary data. Self-encryption and self-transformation are very easy. Nowadays, the Trojan horse scripts on the Internet usually use deformation and encryption methods. Compared with traditional PE (Portable Executable, portable executable file) format viruses, they are more diverse and easier to detect. more difficult. At the same time, since the location of the vulnerability exploited by the unknown vulnerability and the 0day vuln...

AI Technical Summary

Problems solved by technology

[0002] As webpage Trojan horse scripts are exploited according to script vulnerabilities to become the mainstream means of Internet virus transmission, the number of attack scripts using browser and system vulnerabilities continues to increase. Due to the change of a string and encryption, it will produce completely different binary data. Self-encryption and self-transformation are very easy. Nowadays, the Trojan horse scripts on the Internet usually use deformation and encryption methods. Compared with traditional PE (Portable Executable, portable executable file) format viruses, they are more diverse and easier to detect. more difficult

At the same time, because the location of the vulnerability exploited by the unknown vulnerability and the 0day vulnerability and the calling method used are unknown, the existing technology cannot detect the unknown vulnerability or the 0day vulnerability based on the known feature matching method

Images