Malicious script detection method and device

Abstract

The invention discloses a malicious script detection method and device, and the method comprises the following steps: obtaining a to-be-detected script, and obtaining a plurality of logic blocks of the to-be-detected script through lexical grammatical analysis; carrying out dynamic processing on each logic block of the plurality of logic blocks, and obtaining a processing result of each logic block; and obtaining a malicious detection result of the to-be-detected script according to the processing result of each logic block. According to the method, the malicious codes can be unconditionally executed in dynamic detection, real malicious behaviors of the malicious scripts can be rapidly and accurately detected, effective detection of the malicious scripts is achieved, and therefore the detection accuracy and reliability are effectively improved, a user can be prevented from being attacked by the malicious scripts, and the use experience of the user is improved.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a method and device for detecting malicious scripts. Background technique [0002] In related technologies, the malicious code dynamic detection method is to judge the malicious behavior of code execution in a virtual environment, so as to realize the dynamic detection of malicious code. [0003] However, for malicious scripts that bypass malicious code execution by anti-sandbox methods such as delaying and judging the current time, and malicious scripts that use encryption, compression, obfuscation, etc. to hide the malicious behavior of the script and prolong the analyst's analysis cycle , due to the inability to execute the actual malicious code, the malicious behavior cannot be effectively detected. Therefore, in related technologies, it is often impossible to effectively detect the malicious script that does not execute the actual malicious code, so that th...

AI Technical Summary

Problems solved by technology

[0003] However, for malicious scripts that bypass malicious code execution by anti-sandbox methods such as delaying and judging the current time, and malicious scripts that use encryption, compression, obfuscation, etc. to hide the malicious behavior of the script and prolong the analysis cycle of analysts , because the actual malicious code cannot be executed, the malicious behavior cannot be effectively detected. Therefore, in related technologies, it is often impossible to effectively detect the malicious script that does not execute the actual malicious code, so it is often impossible to detect the real malicious behavior of the malicious script. The accuracy and reliability of the system are poor, and it is often impossible to effectively avoid malicious script attacks, which greatly reduces the user experience and needs to be resolved urgently

Images