Intelligent detection method for Java script malicious code facing to the webpage

Abstract

The invention relates to the internet safety technology, and is designed to provide an intelligent detection method for Java script malicious code facing to the webpage. The method comprises three processes of optimization of sample, safety detecting and renewal of optimization. A classical N-gram statistical model and a KNN grader are efficiently fused by means of the efficient mixing of static detecting and dynamic detecting. The dynamic behavioural analysis of the code is realized by setting up N-gram characteristic of a Java Script machine code operation order. The efficiency of the static classification detection is largely improved by the optimization of the sample relayed on the KNN grader. The suggested intelligent detecting method is specially provided with operability, the step of optimization of sample can ensure that the classification effectiveness is not decreased when a training script is enlarged, and the step of the safety detecting can ensure to execute the high-efficient intelligent detecting based in the optimization of sample, and the step of the renewal of optimization can ensure thag the precision of the intelligent detecting is not be declined when new malicious script is increased. The method has the advantages of providing the ability of detecting the new malicious script and the dynamic optimization adjust ability for continuing work.

Description

technical field [0001] The invention relates to a JavaScript malicious code intelligent detection method. Background technique [0002] Malicious code is one of the important forms of threatening computer security. It is essentially a piece of computer code or program (a piece of instruction). This piece of code can perform a series of operations containing malicious intentions according to the attacker's wishes; the form of code may be executable Coded instructions, scripting language, word processing macro language, or other types. Typical malicious code includes viruses, worms, and Trojan horses. [0003] The research object of the present invention is the JavaScript script that can be embedded in the webpage, which is an object-based and event-driven client-side scripting language. JavaScript enables a real-time, dynamic, and interactive relationship between web pages and users, enabling web pages to contain more active elements and more exciting content, but it also m...

AI Technical Summary

Problems solved by technology

[0019] The technical problem to be solved by the present invention is, aiming at the common code confusion phenomenon of JavaScript malicious scripts, in order to overcome the shortcomings that static detection technology cannot detect new malicious codes, and solve the problem that dynamic behavior detection technology has low efficiency and difficult feature extraction To solve these problems, provide a general and robust new intelligent detection method based on updatable preferred samples, without static code signatures and dynamic behavior signatures, capable of detecting new malicious codes

Images