A method and system for monitoring malware status.

Abstract

The invention relates to a method and system (10) that enables checking whether at least one script running in a browser contains malware when a browser is accessed from a client device (11). Figure 1

Description

1 TARIFF A method for checking the malware status. AND THE SYSTEM TECHNICAL FIELD The invention refers to the situation where login is made from a client device to a browser. whether at least one script running in the browser contains malware It relates to a method and system that enables control. 10 PREVIOUS TECHNIQUE The vast majority of internet-based applications and websites rely on user interaction. 15 client-side scripts to perform the based functions It uses these scripts when the page loads or when interacting with the user. It activates when this happens, generating dynamic content and collecting user data. performing operations or communicating with other sources in the background However, this provides an attack surface for malicious malware. It creates. Malicious software uses a scripting infrastructure to attack the user without their knowledge. They are able to carry out various malicious operations without permission; for example, unauthorized data of personal information. obtaining, executing unauthorized commands, or accessing other sources through the user's browser Situations such as being directed in a certain direction may occur. Script-based malware often attacks directly at the moment of page load. It does not work; instead, it depends on user behavior or has a time delay. It is programmed to be triggered. This type of content is included in the page source code from the beginning. Instead of being retrieved, it can be incorporated into the page content later during runtime, or even the content itself. It is dynamically generated during the changes. Furthermore, malicious functions are a single unit. Not in a large block of code, but in small commands that gain meaning when broken down and combined. 30 It is also common to see cases where it is hidden in the form of blocks. All these methods, detection by traditional security systems and browser extensions based on static analysis This greatly limits its capacity. On the other hand, word games or 35 based solely on the content of the scripts Pattern searches detect malware disguised with modified or obfuscation techniques. It is insufficient at capturing the code. Therefore, it only captures the raw scripts. 2 There is a growing need to analyze it not only at the level of representation but also at the level of structural representation. This is increasing. Current solutions often only allow files to be downloaded via network traffic. to check and analyze on-page code generation or dynamically loaded command content. This does not include any undetected malware samples. This leads to its spread and the creation of vulnerabilities that threaten user security. 5 In conclusion, all the problems mentioned above necessitate an innovation in the relevant technical field. It has made it mandatory. BRIEF DESCRIPTION OF THE INVENTION 10 The present invention aims to eliminate the aforementioned disadvantages and contribute to the relevant technical field. It is related to a method and system aimed at bringing new advantages. One aim of the invention is to analyze scripts before they are run in the browser. by providing a method that enables the early detection of malware, and The goal is to establish a system. Another aim of the invention is to ensure that scripts are structured in a way that is not affected by formal differences. a summarizing and comparing method that allows evaluation based on similarities and 20 The goal is to establish the system. Another purpose of the invention is to install extensions in the browser, to modify the internal structure of the browser. or by enabling the detection of malware without requiring user permission. The goal is to create a user-friendly method and system. 25 All the purposes mentioned above and those that will emerge from the detailed explanation below. The present invention enables the entry of a user device into a browser. In that case, at least one script running in the mentioned browser is malicious. It is a method that allows checking the software inclusion status. Accordingly, novelty is 30 The aforementioned script is sent to a database server, the mentioned database The script on the server obtains information about an abstract syntax tree using an AST model. This involves creating a summary of the abstract syntax tree information mentioned using a TLSH model. the creation of the aforementioned summary of reference malware in the database server Comparison with the summaries, the summary is at least 35% higher than the aforementioned reference malware summaries. Detecting a correlation with at least one of them, the summary being linked to the reference malware. Creating a similarity score based on the degree of relationship, the aforementioned similarity 3 It includes the steps to transmit the score to the aforementioned client device. Thus, the command By analyzing the file, hidden or formally altered malware can be identified. This ensures reliable detection of software. A characteristic of a possible construction of the invention is that the similarity score is a reference threshold similarity 5. Comparison of the score with the aforementioned reference threshold similarity score If the score is greater than the aforementioned client device similarity score, then the score should be included. It includes the steps for transmitting a warning. Another possible configuration of the invention involves the aforementioned abstract being in database 10 before the step of comparing with the summaries of reference malware on the server The transmission of malicious software scripts to the database server, the aforementioned database The malware scripts on the server are abstracted using an AST model. Obtaining the syntax tree information, abstracting the aforementioned malware with a TLSH model The steps for generating malware summaries based on syntax tree information are outlined in section 15. It includes. Another possible configuration of the invention involves the aforementioned script. This involves compressing the data and sending it to the database server. Furthermore, the invention addresses the situation where login is performed from a client device to a browser. whether at least one script running in the browser contains malware to ensure it is checked, follow the procedural steps described in previous requests It is a system that includes a processing unit used to perform tasks. BRIEF DESCRIPTION OF THE FIGURE Figure 1 shows a representative view of the system that is the subject of the invention. DETAILED DESCRIPTION OF THE INVENTION 30 This detailed explanation of the invention does not merely aim to improve understanding of the subject matter; it does not contain any other information. This is explained with examples that will not create a limiting effect. Referring to Figure 1, the invention is based on the principle that when logging into a browser from a client device (11) 35 At least one script running in the mentioned browser contains malware. It is related to a method and system (10) that enables the control of the situation. 4 In a possible configuration of the invention, the browser referred to is an internet browser. The invention... In a possible configuration, the aforementioned script, as is known in technology, is the input. the interaction of the web page in the browser with the user, exchanging data It enables the execution and / or management of visual adjustments. For example, command 5 The file is a type of JavaScript file known in technical terms. These types of scripts are known in technical terms as... to enable buttons to function on the webpage, to retrieve data from forms, sending requests to the server, user interface such as drop-down menus or animations It can contain functional code blocks that enable the creation of behaviors. To the browser Each script that is loaded, when executed, directly displays the page content and the 10-second interaction with the user. Because it may contain commands that could affect interaction, it's important to consider whether the code it contains is reliable. Checking that it is not present is critically important. The system (10) includes a database server (12). A possible invention In its configuration, the database server (12) mentioned runs command 15 on the client device (11). recording, monitoring, and, if necessary, retrieving the content and data related to the files It is the server that enables the processing. A database in a possible configuration of the invention. The server (12) can run in a virtual machine environment. The system (10) checks whether the script contains malware. 20 It includes a processor unit (14) to provide. In a possible configuration of the invention The mentioned processing unit (14) can be a CPU, a GPU, a microprocessor, etc. In a possible configuration of the invention, the malware is placed on a client device (11) When run, the system (10) uses resources without permission, accesses user data, and uses unauthorized resources. 25 script contents that perform operations or threaten the security of the device It may include. The processor unit (14) transmits the script to the database via a communication unit (13). It ensures that it is transmitted to the server (12). In a possible configuration of the invention The communication unit mentioned (13) is a modem, Wi-Fi card, mobile data network, etc. 30 It may include. In a possible configuration of the invention, the script would be compressed and sent to the database server. (12) is transmitted. Thus, the script is transmitted with less data transmission overhead. Thanks to this, storage efficiency is increased on the database server (12). In addition, 35 is transmitted. The scripts are saved on the database server (12). In this way, the system (10), Not limited to just instant detection processes, but also including analyses related to historical data and long-term processes. It can also support long-term security monitoring. The processor unit (14) has an AST model of the script on the database server (12). It enables the acquisition of abstract syntax tree information. The aforementioned AST (abstract syntax 5) The tree model, as is well known in the field, is the structure of the statements and commands in a script. Stripped of their formal structures, they represent only their logical and structural relationships. It is a data model that enables the script to be executed using a semantic structure. preserved; avoiding formal differences such as spaces, variable names, or comment lines. An unaffected analysis basis is being created. Accordingly, the AST model, command 10 It parses the statements in the file and arranges them in a tree structure, thus The relationships between the commands are clearly presented. This allows the commands to be understood in a clear and understandable way. Changing variable names in the file, including spaces and formatting characters. Superficial differences, such as removing commands or writing them in a different order, can disrupt the analysis process. It does not affect it. Thus, although the system (10) appears formally different, it is logically 15 It also enables the reliable detection of malicious scripts that are identical. Since obtaining abstract syntax tree information using the AST model is a well-known technique, it is not discussed here. No further details were given. A summary of abstract syntax tree information is generated using a TLSH model. TLSH 20 The Trend Locality Sensitive Hashing (TRM) model detects small differences between data with similar structures. It is a structure-sensitive summarization model that can also take differences into account. Thanks to this model, The resulting abstract syntax tree information is converted into a fixed-length character string. The system (10) is brought into a form suitable for comparison. Thus, the command The structural content of the file is summarized as a numerically defined and analyzable summary value of 25. This is how it is represented. Since the technique of generating summaries with the TLSH model is well known in the field. This is not detailed further here. The summary includes the reference malware summaries (12) on the database server. is compared. The processor unit (14) is at least 30 of the reference malware summaries of the summary. It enables the identification of a relationship with at least one person. Each reference The malware summary is a structural breakdown of scripts previously confirmed to be malicious. The summaries represent the system's (10) counterparts. The processor unit (14) represents these The summary generated as a result of the comparison should be at least as good as the reference malware summaries. It enables the analysis of whether it structurally overlaps with someone else, and this 35 It enables the determination of whether or not there is a match in this regard. 6 In a possible configuration of the invention, the referenced malware summaries mentioned Processor unit (14) for the creation of the database of malware scripts It ensures that it is transmitted to the server (12). The malicious software is on the database server (12). Scripts are used to obtain abstract syntax tree information of malware using the AST model. Next, using the TLSH model, 5 pieces of information regarding the abstract syntax tree of the aforementioned malware were obtained. Malware summaries are being generated. Therefore, the reference malware summary is more... first, scripts identified as malicious, malware abstraction tree It expresses the summary values ​​formed based on the information. The possibility of the invention. Reference malware summaries created in a structure, the system (10) then 10 will be used as a benchmark in evaluating the scripts to be analyzed. Each reference is stored on the database server (12) for use. Since the software summary represents the structural characteristics of the relevant malware sample, subsequently It is possible to determine whether the obtained summaries are related to these recorded values. The processor unit (14) is a 15 depending on whether the summary is related to the reference malware summary. It enables the generation of a similarity score. The aforementioned similarity score is used in relation to the command. objective analysis of the file's level of similarity to known malware. and provides a comparable criterion. Thus, the system (10) only detects the existence of a match. Not only that, it can also numerically express the significance level of this match. The processor unit (14) enables the similarity score to be transmitted to the client device (11). Accordingly, the similarity score is presented to users in a client interface. The invention... In a possible configuration, the client interface mentioned could be a computer, tablet, or mobile phone. This could be a website accessed via mobile devices, etc. In this way... The level of structural similarity between the analyzed script and the reference malware is 25. It is presented for evaluation on the client device (11). Thus, the user or system (10) components, potential security risk level of the script Numerical and interpretable feedback is provided regarding the similarity score of the client. Transmission to the device (11) enables quick and data-driven decisions about the operations to be performed in the browser. and timely preventive measures against malicious software content 30 It enables its implementation. In a possible configuration of the invention, the similarity score is compared with a reference threshold similarity score. They are compared. The similarity score must be greater than the reference threshold similarity score. In this case, the processor unit (14) gives a warning with a similarity score to the client device (11) 35 This ensures that the similarity score and warning are communicated to users via the client. This is presented to users on the interface. In this way, the known aspects of the analyzed script are revealed. 7 It automatically checks whether the similarity to malware samples exceeds a critical level. It can be determined as follows. Thus, the system (10) with harmless variants with low similarity. Separating highly similar potential threats from each other and in dangerous situations It ensures that users are warned. In a possible configuration of the invention, the system (10) is the command running in the scanner. In order to track content changes in the files, changes made to the page structure It includes a monitoring mechanism that allows you to track incoming updates. (mentioned) The tracking mechanism, as is known in technology, occurs in the page content within the browser environment. It is an interface component that helps detect incoming structural or textual changes. 10 The tracking mechanism dynamically adds or removes data after the page loads. By enabling the detection of updated content, not just during the initial upload, It also enables the detection of harmful content that may occur during operation. In this context, with each new content change detected by the monitoring mechanism, the command The analysis process for the file is being restarted, and summary extraction and comparison are being carried out. 15 The steps are repeated. In a possible configuration of the invention, the system (10) has the abstract in the database server (12) a benchmark unit for comparison with reference malware summaries It includes. In a possible configuration of the invention, the unit of comparison mentioned is 20 in the art. It is a well-known vector similarity comparison modulus. The vector similarity mentioned is... comparison module, numerical vector corresponding to the summary, reference malware by comparing the numerical vectors corresponding to their summaries, the similarity between them It enables detection. In a possible configuration of the invention, the processor unit would consist of an executor module and an assembler module. It is associated with a worker module and a watcher module. The aforementioned executor module is the client device. It ensures the coordination of the system on its part. The aforementioned collector module provides analysis. It packages the script to be executed along with the relevant metadata and sends it to the executor. It transmits. The mentioned worker module receives the JavaScript files before execution and transmits them. It transmits the information to the collector. The aforementioned watch module performs the same tasks as the worker, whether... from potential vulnerabilities in the browser or in the relevant operating system running on the browser JavaScript files that can be injected locally by exploiting vulnerabilities is carrying out. 35 A sample working scenario for the invention is given below; 8 In a possible application of the invention, a user could access the internet via a client device. when you access your browser, a web page is created to be run in that browser. It is being loaded. At least one script that comes with the loaded page is loaded by the processor unit (14) It is being analyzed by [the system / organization]. Before the script is even executed. The analysis is initiated and the contents of the script are compressed and sent to a database server. (12) is transmitted. In this way, the system transmits the script before it is executed on the client device. (10) is being evaluated by; the potentially harmful software it contains, any It can be detected before accessing an interaction or system (10) resource. Thus, the malicious software can run on the system (10) or in any user environment This prevents negative impacts from occurring. 10 The script that reaches the database server (12) is abstracted by the processor unit (14). The syntax tree model (AST) is used to convert abstract syntax tree information. This process... During this process, the statements in the script are parsed and represent logical structures. In this way, it is transformed into a hierarchical tree structure in the form of nodes. These 15 obtained Abstract syntax tree information enables the system to perform (10) structure-based analysis. Then the processor unit (14) uses this information to fix a TLSH model. It creates a numerical summary of a certain length. The resulting summary is 20, which was previously generated by the system (10) and stored in the database. The processor unit (14) compares the summary with reference malware summaries. It evaluates whether it structurally overlaps with one of the references. If one If a relationship is detected, a corresponding similarity score is generated, and This score is transmitted to the client device (11). The mentioned similarity score is the reference threshold. The script, analyzed by comparing it with the similarity score, contains a critical level of risk and is 25. It has been determined that it does not contain [this]. If the threshold value is exceeded, the client device displays a warning message. They are informed by... Reference threshold used by system (10) in a possible configuration of the invention The similarity score changes dynamically depending on time or threat intensity. It can be updated. In this way, the system (10) is more sensitive to the threat levels in the environment. By becoming more adaptive, they can develop adaptive security policies. In addition, the system (10) displays the page in the browser environment not only when the page is first loaded. It can also track subsequent updates to the content. Page 35 when a content change is detected in its structure, for example, in a running script When new content is added later, the monitoring mechanism detects this change. 9 When a change is detected, the relevant content is re-analyzed by the system (10). This is being done. Accordingly, abstract syntax tree information is being recreated, and a summary is being made. is obtained and reference comparisons are repeated. In this way, the system (10), Potentially harmful substances injected or dynamically generated during operation It operates in a way that can also detect software code. 5 The scope of protection of the invention is specified in the claims attached hereto, and these details are strictly adhered to. The explanation cannot be limited to those given for illustrative purposes. Because a technically skilled person... the person, without deviating from the main theme of the invention, in light of what has been described above, similar It is clear that this can lead to the emergence of new structures. 10 REFERENCE NUMBERS GIVEN IN THE FIGURE System 11 Client devices 5 12 Database servers 13 Communication units 14 Processor units

Claims

11 REQUESTS 1. When logging into a browser from a client device (11) the aforementioned At least one script running in the browser contains malware. It is a method that allows the status to be checked, and its feature is; 5 - transmitting the aforementioned script to a database server (12), - the script (12) on the mentioned database server with an AST model obtaining information about an abstract syntax tree, - a summary regarding the abstract syntax tree information mentioned with a TLSH model. creation, 10 - the referenced malware on the database server (12) Comparison with summaries, - the summary should include at least one of the referenced malware summaries. determining the relationship status, - Similarity based on whether the summary is related to the reference malware 15 generating the score, - transmitting the mentioned similarity score to the mentioned client device (11) It includes the steps.

2. It is a method according to claim 1, and its characteristic is; 20 - Comparison of the similarity score with a reference threshold similarity score, - the similarity score must be greater than the aforementioned reference threshold similarity score. In this case, the client device mentioned (11) is given a similarity score along with a transmission of the warning It includes the steps. 25 3. This is a method according to claim 1, and its characteristic is that the aforementioned summary is stored on the database server. (12) before the step of comparing with the summaries of the reference malware. - transmission of malicious software scripts to the database server (12), - 30 malicious software scripts on the mentioned database server (12) Obtaining abstract syntax tree information of malware using the AST model, - a TLSH model to access the abstract syntax tree information of the aforementioned malware. creation of related malware summaries It includes the steps. 35 4. This is a method according to claim 1, and its characteristic is that the aforementioned script is compressed. This includes the step of transmitting to the database server (12). 12 5. When logging into a browser from a client device (11), the aforementioned At least one script running in the browser contains malware. the method described in previous requests to ensure the status is checked It is a system that includes a processor unit (14) which is used to perform its steps. (10). 5

Images