Malicious script behavior detection

Abstract

Embodiments of the present disclosure relate to behavioral detection of malicious scripts. A script analysis platform may obtain a script associated with content, wherein the script includes one or more functions, and the one or more functions include one or more expressions. The script analysis platform may parse the script to generate a data structure, and may traverse the data structure to determine one or more functions and determine properties of one or more expressions, wherein traversing the data structure includes evaluating one or more constant subexpressions of the one or more expressions. The script analysis platform may analyze properties of one or more expressions to determine whether the script exhibits malicious behavior. The script analysis platform may cause an action on the script or content to be executed based on determining whether the script exhibits malicious behavior.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to detection and analysis of scripts, and more particularly to behavior detection and analysis of malicious scripts. Background Art

[0002] The anti-malware device may analyze the script to determine whether the script is a malicious script. For example, the anti-malware device may analyze the script to find hard-coded patterns that are known to be associated with malicious behavior. Summary of the invention

[0003] According to some implementations, a method may include: obtaining, by a device, a script associated with content, wherein the script includes one or more functions, the one or more functions including one or more expressions; parsing, by the device, the script to generate a data structure, wherein the data structure represents a grammatical structure of the script; traversing, by the device, the data structure to determine one or more functions; traversing, by the device based on the one or more functions, the data structure to determine properties of one or more expressions, wherein traversing the data structure to determine properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps determine properties of the one or more expressions; analyzing, by the device, the properties of the one or more expressions to determine whether the script exhibits malicious behavior; and based on determining whether the script exhibits malicious behavior, causing an action regarding the script or the content to be performed by the device.

[0004] According to some implementations, a device may include: one or more memories and one or more processors to: obtain a script associated with content from a content collection device, wherein the script includes one or more functions, and the one or more functions include one or more expressions; parse the script to generate a data structure; traverse the data structure to determine the one or more functions; traverse the data structure based on the one or more functions to determine one or more properties of the one or more expressions, wherein traversing the data structure to determine the one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps to determine one or more properties of the one or more expressions; obtain information describing one or more properties of malicious behavior; analyze one or more properties of the one or more expressions based on the information to determine whether the script exhibits malicious behavior; and based on determining whether the script exhibits malicious behavior, cause an action regarding the script or content to be performed.

[0005] According to some implementations, a non-transitory computer-readable medium may store instructions including one or more instructions that, when executed by one or more processors, may cause the one or more processors to: obtain a script associated with content, wherein the script includes one or more functions, wherein the one or more functions include one or more expressions; after obtaining the script, allocate a block of memory; parse the script to generate a data structure that can be stored in the block of memory, wherein the data structure represents a grammatical structure of at least some of the script; store the data structure in the block of memory; traverse the data structure to determine one or more functions; based on the one or more functions, traverse the data structure to determine one or more properties of the one or more expressions, wherein traversing the data structure to determine the one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps to determine the one or more properties of the one or more expressions; analyze one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior; and based on determining whether the script exhibits malicious behavior, cause an action regarding the script or the content to be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1A-Figure 1D is a diagram of one or more example implementations described herein.

[0007] Figure 2 is a diagram of an example environment in which the systems and / or methods described herein may be implemented.

[0008] Figure 3A and Figure 3B yes Figure 2 A diagram of example components of one or more devices.

[0009] Figure 4-Figure 6 is a flow chart of an example process for behavioral detection of malicious scripts. DETAILED DESCRIPTION

[0010] The following detailed description of example implementations refers to the accompanying drawings.The same reference numerals in different drawings may identify the same or similar elements.

[0011] Anti-malware devices use different methods to detect malicious scripts associated with content (e.g., document files, portable document format (PDF) files, email document files, etc.). For example, an anti-malware device may analyze the script to find hard-coded patterns that are known to be associated with malicious behavior (e.g., using a signature-based analysis method). However, in some cases, malicious scripts may have polymorphic properties, such as self-modifying code behavior, which may obfuscate hard-coded patterns that are known to be associated with malicious behavior. In addition, malicious scripts may call values, functions, objects, elements, etc. of the runtime environment in which the script is executed, which may further obfuscate the hard-coded patterns. Additionally, malicious scripts continuously change and evolve, which makes it difficult to identify and detect new hard-coded patterns.

[0012] Thus, in many cases, the anti-malware device may not detect malicious scripts that have polymorphic properties, use runtime environment calls, and / or exhibit other new malicious properties that have not been previously identified. This may cause the anti-malware device and / or an additional device associated with the anti-malware device to be infected by the malicious script. This may cause the anti-malware device and / or the additional device to use resources (e.g., processing resources, memory resources, networking resources, power resources, etc.) to copy and propagate the malicious script to other devices, download and propagate additional malicious code, perform one or more malicious actions, etc. In addition, the anti-malware device, the additional device, and / or other devices may use resources to search for, contain, and / or eradicate the malicious script and / or repair damage caused by the malicious script.

[0013] Some implementations described herein provide a script analysis platform device that is capable of determining and analyzing one or more behavioral attributes of a script to determine whether the script is malicious. In some implementations, the script analysis platform can obtain a script associated with content, wherein the script includes one or more functions, and the one or more functions include one or more expressions. In some implementations, the script analysis platform can parse the script to generate a data structure, and can traverse the data structure to determine one or more functions and determine the properties of one or more expressions. In some implementations, the script analysis platform can evaluate one or more constant subexpressions of one or more expressions to help determine the properties of one or more expressions. In some implementations, the script analysis platform can analyze the properties of one or more expressions to determine whether the script exhibits malicious behavior. In some implementations, the script analysis platform can cause an action on the script or content to be executed based on determining whether the script exhibits malicious behavior.

[0014] In this manner, some implementations described herein can save resources (e.g., processing resources, memory resources, networking resources, power resources, etc.) of a script analysis platform and / or an attached device associated with script analysis that would otherwise be used due to the script analysis platform, and / or the attached device would be infected by a malicious script that cannot be detected using a signature-based analysis approach. For example, the script analysis platform can determine that a script exhibits malicious behavior based on properties of one or more expressions of the script, making it unnecessary to identify hard-coded patterns in the script. In addition, the script analysis platform can automatically perform actions such as deletion and / or isolation actions to limit the spread of a malicious script when the script analysis platform identifies the malicious script as exhibiting malicious behavior. This can save resources of the script analysis platform, attached devices, and / or other devices that would otherwise be used to search for, contain, and / or eradicate malicious scripts and / or repair damage caused by malicious scripts.

[0015] Figure 1A-Figure 1D 1 is a diagram of one or more example implementations 100 described herein. Example implementation(s) 100 may include a content collection device and a script analysis platform. The content collection device and / or the script analysis platform may be a computing device, a server device, a cloud computing device, etc. In some implementations, the content collection device and the script analysis platform may be connected via a network such as a wired network (e.g., the Internet or another data network), a wireless network (e.g., a wireless local area network, a wireless wide area network, a cellular network, etc.), etc.

[0016] Some example implementations described herein involve a single content collection device in communication with a single script analysis platform. In some implementations, multiple content collection devices may communicate with one or more script analysis platforms. In some implementations, one or more functions of a content collection device may be performed by the script analysis platform instead of, or in addition to, the content collection device. In some implementations, one or more functions of a script analysis platform may be performed by the content collection device instead of, or in addition to, the script analysis platform.

[0017] like Figure 1A As shown in the figure and numeral 102, the content collection device can collect content from one or more sources ( Figure 1AThe content may be a document file, such as a text document file (e.g., a .txt file), a Microsoft Office document file (e.g., a .docx file, a .xlsx file, a .pptx file, etc.), a portable document format (PDF) file (e.g., a .pdf file), an email document file (e.g., a .eml file, a .msg file, etc.); an image file (e.g., a .jpeg file, a .tiff file, a .gif file, etc.), a video file (e.g., a .mpg file, a .avi file, a .mov file, etc.); an audio file (e.g., a .mp3 file, a .aac file, a .aiff file, etc.); a web page file (e.g., a .html file, a .htm file, a .css file, etc.), etc.

[0018] For example, in some implementations, the content collection device may be an email firewall device that filters incoming email traffic to one or more devices on the network, and may obtain emails by receiving emails from an email server device. As another example, the content collection device may be a file download collection device that downloads files for one or more devices on the network, and may obtain files by downloading files from another device. In another example, the content collection device may crawl (e.g., access and search web pages) web pages to obtain web page files.

[0019] In some implementations, the content may include one or more scripts. For example, the script may be attached to the content (e.g., as an email attachment), embedded in the content (e.g., embedded in the HTML code of a webpage), inserted into the content (e.g., added to a document file as a macro), etc. The script may be a file including one or more instructions that may be executed by a computing device without user interaction. The script may be a specific type of script (e.g., a script that may be programmed using a specific computer language). For example, the script may be a JavaScript script, a Visual Basic (VB) script, a Visual Basic for Applications (VBA) script, a Jscript script, a PowerShell script, etc.

[0020] A script can include one or more functions (e.g., one or more named sections of a script that perform a specific task). Figure 1A As shown in , the example script includes a function called "test3". A function may include one or more expressions (e.g., one or more statements representing instructions and / or values, respectively). For example, Figure 1A As shown in the example script, the expression of the "test3" function includes:

[0021] if (s) v = ar[z];

[0022] s=s+cc[v+4];

[0023] The expression may include one or more constant sub-expressions. The constant sub-expression may be a constant numerical value (e.g., 5, 3.14, -12, etc.), a constant string value (e.g., "hello", "goodbye", etc.), a combination of constant numerical values ​​and / or constant string values ​​(e.g., "7+2", "'hello'+"world'", etc.), a library function call associated with the computer language of the script (e.g., a replace() function call, a split() function call, a call() function call, etc. associated with the JavaScript computer language) called with at least one parameter, the at least one parameter being a constant numerical value, a constant string value, a combination of constant numerical values ​​and / or constant string values, etc.

[0024] As shown in reference numeral 104, the content collection device may remove one or more scripts from the content. For example, the content collection device may search the content to identify one or more scripts and strip the one or more scripts from the content (e.g., remove one or more attachments from an email, remove script code from the HTML code of a web page, remove one or more macros from a document file, etc.). As shown in reference numeral 106, the content collection device may send the one or more scripts to a script analysis platform and / or the script analysis platform may obtain the one or more scripts from the content collection device.

[0025] like Figure 1B As shown in the figure and reference numeral 108, the script analysis platform can parse one or more scripts. For example, the script analysis platform can parse the script of one or more scripts to generate a data structure. The data structure can represent the grammatical structure of the script, such as an abstract syntax tree (AST). For example, Figure 1B As shown in , the script analysis platform can parse the example script to generate an example data structure.

[0026] In some implementations, the script analysis platform may allocate a block of memory to contiguously store two or more elements of a data structure (e.g., branches, nodes, etc.). In this way, the script analysis platform may deallocate memory associated with two or more elements with a single deallocation call, which may improve the speed performance of the script analysis platform after the script analysis platform completes its analysis of the script. In some implementations, the script analysis platform may parse a portion of a script to create a data structure that may be stored in a block of memory. That is, the script analysis platform may create a data structure that represents some (but not necessarily all) of the script so that the script analysis platform may store the data structure in the block of memory.

[0027] like Figure 1C As shown in FIG. 1 and in FIG. 110 , the script analysis platform may traverse the data structure. In some implementations, the script analysis platform may traverse the data structure to determine one or more functions of the script. For example, the script analysis platform may traverse the data structure to extract the names of the one or more functions of the script. In this manner, the script analysis platform may track which functions the script analysis platform has accessed in association with the additional traversals described herein. The script analysis platform may then access any functions that have not been accessed during the additional traversals to ensure that the entire data structure has been traversed.

[0028] In some implementations, the script analysis platform may traverse the data structure to determine properties of one or more expressions of the script. To do so, the script analysis platform may determine one or more branches and / or one or more nodes (e.g., of the data structure) associated with the one or more expressions, and traverse each branch of the one or more branches and / or each node of the one or more nodes. In addition, as the script analysis platform traverses the data structure (e.g., traversing each branch and any nodes associated with each branch), the script analysis platform may maintain a call stack associated with the one or more expressions, and may maintain one or more symbol tables for one or more identifiers associated with the one or more expressions of the script. For example, Figure 1C As shown in , the script analysis platform can traverse example data structures and maintain an example call stack (not shown) and an example symbol table.

[0029] For an identifier associated with a symbol table, the symbol table may include information about the identifier, such as the type of the identifier (e.g., whether the identifier is a number, a string, an object, etc.), the scope of the identifier (e.g., the function to which the identifier belongs), a reference to the assigned value of the identifier (e.g., a reference to a variable value, a reference to an object value, a reference to an array value, etc.), whether the assigned value is assigned in a loop (e.g., a "for" loop, a "while" loop, etc.), whether the assigned value is assigned through a non-trivial assignment call (e.g., whether the assignment of the value of the identifier includes additional references to multiple other identifiers, function calls, etc. that meet a threshold (e.g., when the number of other identifiers, function calls, etc. is greater than or equal to the threshold, the assignment call is non-trivial)), whether the identifier is self-modifying (e.g., whether the identifier references the identifier when a value is assigned to the identifier), etc. For example, if Figure 1CAs shown in , the example symbol table includes entries for identifiers "z", "v", and "s" associated with expressions of the example script. The entry for the "z" identifier includes information indicating that the "z" identifier is assigned a reference value "i" and that the assignment occurs in a loop. The entry for the "v" identifier includes information indicating that the "v" identifier is assigned a reference value "ar[z]" and that the assignment occurs in a loop. The entry for the "s" identifier includes information indicating that "s" is assigned a self-modifying value and that the assignment occurs in a loop.

[0030] In some implementations, one or more attributes of the one or more expressions may be included in one or more symbol tables (e.g., information included in the one or more symbol tables may indicate one or more attributes of the one or more expressions). Additionally, or alternatively, the script analysis platform may determine one or more attributes of the one or more expressions of the script based on the information included in the one or more symbol tables. For example, for an expression including one or more identifiers, the one or more attributes of the expression may include corresponding information about each of the one or more identifiers included in the one or more symbol tables.

[0031] In some implementations, when the script analysis platform traverses the data structure, the script analysis platform may evaluate one or more constant sub-expressions of one or more expressions. For example, when the constant sub-expression includes an assignment of "c=1" (e.g., assigning a constant numeric value of "1" to an identifier "c"), the script analysis platform may evaluate the constant sub-expression by updating the symbol table to indicate that the identifier "c" has a value of "1" rather than a reference to the value "1". As another example, when the constant sub-expression includes a call to "b=String.fromCharCode(c+96)" (e.g., a Javascript library function call that converts a numeric value to a character), the script analysis platform may evaluate the constant sub-expression by updating the symbol table to indicate that the identifier "b" has a string value of "a" (e.g., because c has a value of "1" and the Unicode character code for "a" is "97") rather than a reference to the string value "c+96". Evaluating one or more constant sub-expressions in this manner provides additional information about the one or more expressions while limiting the possibility of inadvertently causing the script to perform malicious behavior. This may assist the script analysis platform in determining properties of one or more expressions.

[0032] like Figure 1CAs shown in the figure 112, the script analysis platform can obtain information describing one or more properties of malicious behavior. For example, the script analysis platform can obtain a description file describing one or more properties (e.g., using computer code, text description, etc.). The description file can also include a description of one or more property exceptions, such as when the properties usually associated with malicious behavior are not related to the malicious behavior. For example, a script packer (packer) using self-modifying code is an exception to the rule that self-modifying code behavior is a malicious behavior attribute. In some implementations, different devices such as client devices associated with the script analysis platform can send information to the script analysis platform. In this way, the script analysis platform can be periodically updated with the latest information about the nature of malicious behavior (e.g., on a predetermined basis, on an on-demand basis, on a triggered basis, on a self-organized basis, etc.). This enables the script analysis platform to more effectively identify the evolving nature of malicious behavior. This also reduces the time and resources (e.g., resources to maintain and update the script analysis platform) otherwise required to upgrade the script analysis platform.

[0033] As shown in the figure 114, the script analysis platform can analyze one or more properties of one or more expressions to determine whether the script exhibits malicious behavior, such as self-modifying code behavior. In some implementations, the malicious behavior can have one or more properties, such as accessing global objects using complex array access; calling functions by calculating complex expressions; decoding string values; calling evaluation or execution functions by performing complex string calculations, etc. In some implementations, the script analysis platform can identify and / or determine one or more properties based on information obtained by the script analysis platform. For example, the script analysis platform can parse a description file to determine a description of one or more properties of malicious behavior.

[0034] In some implementations, the script analysis platform may search one or more symbol tables for attributes that correspond to properties of malicious behavior. For example, the script analysis platform may search a symbol table for an attribute that indicates that an identifier is assigned a decoded string value. In some implementations, the script analysis platform may determine that one or more attributes of one or more expressions correspond to at least one property of malicious behavior, and therefore the script exhibits malicious behavior. Additionally, or alternatively, the script analysis platform may determine that one or more attributes do not correspond to any of the one or more properties of malicious behavior, and therefore the script does not exhibit malicious behavior.

[0035] In some implementations, the script analysis platform may identify a set of attributes (e.g., at least one attribute), where each attribute of the set of attributes corresponds to one or more properties of malicious behavior. The script analysis platform may analyze the set of attributes (e.g., analyze each attribute of the set of attributes in combination) to determine whether the script exhibits malicious behavior. For example, the script analysis platform may determine whether the set of attributes corresponds to one or more property exceptions of a description file to determine whether the script exhibits malicious behavior.

[0036] As shown in the figure numeral 116, the script analysis platform can cause an action to be performed with respect to the script or content. In some implementations, the script analysis platform can cause an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior. For example, the script analysis platform can cause an action to be performed by performing the action or causing another device to perform the action. In some implementations, the script analysis platform can generate a message including one or more instructions to perform the action. The script analysis platform can send the message to different devices, such as a content collection device, and the different devices can receive the message, which can cause the different devices to read the message and execute one or more instructions to perform the action.

[0037] In some implementations, the script analysis platform may cause, based on determining that the script exhibits malicious behavior, the content or script to be removed from the content collection device; the content or script to be quarantined on the content collection device to prohibit access to the content or script; a search is performed via the network for other instances of the content or script on one or more other devices and other instances to be deleted; one or more other devices are analyzed for malicious behavior; network connectivity modification for one or more other devices (e.g., limiting access to a local area network, the Internet, email, etc.), etc. Additionally, or alternatively, the script analysis platform may cause the content collection device to send the content or script to a different device (e.g., causing the content collection device to send the content or script to the original target device for the content or script) based on determining that the script does not exhibit malicious behavior.

[0038] As noted above, Figure 1A-Figure 1D These are provided only as one or more examples. Other examples may be related to Figure 1A-Figure 1D Different than described.

[0039] Figure 2 2 is a diagram of an example environment 200 in which the systems and / or methods described herein may be implemented. Figure 2 As shown in , environment 200 may include content collection device 210, network 220, script analysis platform 230, one or more computing resources 234, and / or cloud computing environment 232. The devices of environment 200 may be interconnected via wired connections, wireless connections, or a combination of wired and wireless connections.

[0040] The content collection device 210 includes one or more devices capable of receiving, generating, storing, processing, analyzing, and / or providing information such as the information described herein (e.g., content and / or scripts). For example, the content collection device 210 may include a computer (e.g., a desktop computer, a laptop computer, a tablet computer, a handheld computer, a server device, etc.), a mobile phone (e.g., a smart phone, a wireless phone, etc.), an Internet of Things (IoT) device or smart device, a traffic transmission device such as a router, a gateway, a switch, a firewall, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server, a server executing a virtual machine, etc.), a security device, an intrusion detection device, a load balancer, or a similar type of device. In some implementations, the content collection device 210 may receive information from and / or transmit information to the script analysis platform 230, such as via a network 220, etc. In some implementations, the content collection device 210 may be a physical device implemented in a housing (such as a chassis). In some implementations, the content collection device 210 may be a virtual device implemented by one or more computer devices in a cloud computing environment or a data center.

[0041] The network 220 includes one or more wired and / or wireless networks. For example, the network 220 may include a cellular network (e.g., a fifth generation (5G) network, a fourth generation (4G) network such as a long term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, a cloud computing network, etc., and / or a combination of these or other types of networks.

[0042] The script analysis platform 230 includes one or more devices capable of obtaining information such as one or more scripts associated with the content. In some implementations, the script analysis platform 230 can obtain the script, can parse the script to generate a data structure, and can traverse the data structure to determine one or more functions of the script and determine the properties of one or more expressions of one or more functions of the script. In some implementations, the script analysis platform 230 can evaluate one or more constant sub-expressions of one or more expressions when traversing the data structure. In some implementations, the script analysis platform 230 can analyze the properties of one or more expressions to determine whether the script exhibits malicious behavior, and can cause an action on the script or content to be executed based on determining whether the script exhibits malicious behavior. In some implementations, the script analysis platform 230 can be designed to be modular so that certain software components can be swapped in or out depending on specific needs. In this way, the script analysis platform 230 can be easily and / or quickly reconfigured for different purposes. In some implementations, the script analysis platform 230 can receive information from the content collection device 210 and / or transmit information to the content collection device 210, such as via the network 220.

[0043] In some implementations, as shown, the script analysis platform 230 can be hosted in a cloud computing environment 232. It is worth noting that although the implementations described herein describe the script analysis platform 230 as being hosted in a cloud computing environment 232, in some implementations, the script analysis platform 230 can be non-cloud-based (i.e., can be implemented outside of a cloud computing environment) or can be partially cloud-based.

[0044] Cloud computing environment 232 includes an environment that hosts script analysis platform 230. Cloud computing environment 232 can provide computing, software, data access, storage, etc. services that do not require end users to know the physical location and configuration of the (multiple) system(s) and / or (multiple) devices that host script analysis platform 230. As shown, cloud computing environment 232 can include a set of computing resources 234 (collectively, "computing resources 234" and individually, "computing resources 234").

[0045] The computing resources 234 include one or more personal computers, workstation computers, server devices, or other types of computing and / or communication devices. In some implementations, the computing resources 234 can host the script analysis platform 230. Cloud resources can include computing instances executed in the computing resources 234, storage devices provided in the computing resources 234, data transmission devices provided by the computing resources 234, etc. In some implementations, the computing resources 234 can communicate with other computing resources 234 via wired connections, wireless connections, or a combination of wired and wireless connections.

[0046] like Figure 2 As further shown in FIG. 1 , the computing resources 234 include a set of cloud resources, such as one or more applications (“APP”) 234 - 1 , one or more virtual machines (“VM”) 234 - 2 , a virtualized storage device (“VS”) 234 - 3 , one or more hypervisors (“HYP”) 234 - 4 , and the like.

[0047] The applications 234-1 include one or more software applications that may be provided to or accessed by the content collection device 210. The applications 234-1 may eliminate the need to install and execute software applications on the content collection device 210. For example, the applications 234-1 may include software associated with the script analysis platform 230 and / or any other software that may be provided via the cloud computing environment 232. In some implementations, one application 234-1 may send / receive information to / from one or more other applications 234-1 via the virtual machine 234-2.

[0048] Virtual machine 234-2 includes a software implementation of a machine (e.g., a computer) that executes programs, such as a physical machine. Virtual machine 234-2 can be a system virtual machine or a process virtual machine, depending on the use and correspondence of virtual machine 234-2 to any real machine. System virtual machines can provide a complete system platform that supports the execution of a complete operating system ("OS"). Process virtual machines can execute a single program and can support a single process. In some implementations, virtual machine 234-2 can execute on behalf of a user (e.g., a user of content collection device 210) and can manage the infrastructure of cloud computing environment 232, such as data management, synchronization, or long-term data transfer.

[0049] The virtualized storage device 234-3 includes one or more storage systems and / or one or more devices using virtualization technology within the storage system or device of the computing resource 234. In some implementations, in the context of the storage system, the types of virtualization may include block virtualization and file virtualization. Block virtualization may refer to the abstraction (or separation) of logical storage from physical storage, so that the storage system can be accessed without considering the physical storage or heterogeneous structure. Separation may allow administrators of the storage system to flexibly manage how the administrator manages storage for end users. File virtualization may eliminate the dependency between data accessed at the file level and the location where the file is physically stored. This may enable optimization of storage usage, server consolidation, and / or non-disruptive file migration performance.

[0050] Hypervisor 234-4 may provide hardware virtualization technology that allows multiple operating systems (e.g., "guest operating systems") to execute simultaneously on a host computer (such as computing resource 234). Hypervisor 234-4 may present a virtual operating platform to the guest operating system and may manage the execution of the guest operating system. Multiple instances of various operating systems may share virtualized hardware resources.

[0051] Figure 2 The number and arrangement of devices and networks shown in the are provided as one or more examples. Figure 2 There may be additional devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than those shown in . In addition, Figure 2 Two or more of the devices shown in may be implemented in a single device, or Figure 2 The single device shown in can be implemented as multiple distributed devices. Additionally, or alternatively, a set of devices (eg, one or more devices) of environment 200 can perform one or more functions described as being performed by another set of devices of environment 200.

[0052] Figure 3A-3B yes Figure 2 A diagram of example components of one or more devices. Figure 3A 2 is a diagram of example components of device 300. Device 300 may correspond to content collection device 210, script analysis platform 230, cloud computing environment 232, computing resources 234, etc. In some implementations, content collection device 210, script analysis platform 230, cloud computing environment 232, computing resources 234, etc. may include one or more devices 300 and / or one or more components of device 300. Figure 3A As shown in , device 300 may include a bus 305 , a processor 310 , a memory 315 , a storage component 320 , an input component 325 , an output component 330 , and a communication interface 335 .

[0053] The bus 305 includes components that allow communication between components of the device 300. The processor 310 is implemented in hardware, firmware, or a combination of hardware and software. The processor 310 takes the form of a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an ASIC, or another type of processing component. In some implementations, the processor 310 includes one or more processors that can be programmed to perform functions. The memory 315 includes a random access memory (RAM), a read-only memory (ROM), and / or another type of dynamic or static storage device (e.g., flash memory, magnetic memory, and / or optical memory) that stores information and / or instructions for use by the processor 310.

[0054] Storage component 320 stores information and / or software related to the operation and use of device 300. For example, storage component 320 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, and / or a solid-state disk), a compact disk (CD), a digital versatile disk (DVD), a floppy disk, a cassette, a magnetic tape, and / or another type of non-transitory computer-readable medium and a corresponding drive.

[0055] Input components 325 include components that allow device 300 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, and / or a microphone). Additionally, or alternatively, input components 325 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, and / or an actuator). Output components 330 include components that provide output information from device 300 (e.g., a display, a speaker, and / or one or more light emitting diodes (LEDs)).

[0056] The communication interface 335 includes a transceiver-like component (e.g., a transceiver and / or a separate receiver and transmitter) that enables the device 300 to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of a wired and wireless connection. The communication interface 335 can allow the device 300 to receive information from another device and / or provide information to another device. For example, the communication interface 335 can include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi interface, a cellular network interface, etc.

[0057] Device 300 can perform one or more processes described herein. Device 300 can perform these processes based on processor 310 executing software instructions stored by non-transient computer-readable media such as memory 315 and / or storage component 320. Computer-readable media is defined herein as non-transient memory devices. Memory devices include memory space within a single physical storage device or memory space distributed across multiple physical storage devices.

[0058] The software instructions may be read into the memory 315 and / or storage component 320 from another computer-readable medium or from another device via the communication interface 335. When executed, the software instructions stored in the memory 315 and / or storage component 320 may cause the processor 310 to perform one or more processes described herein. Additionally, or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, the implementations described herein are not limited to any specific combination of hardware circuitry and software.

[0059] Figure 3A The number and arrangement of components shown in the FIG. are provided as examples. Figure 3A Device 300 may include additional components, fewer components, different components, or differently arranged components compared to those components shown in . Additionally, or alternatively, a set of components (e.g., one or more components) of device 300 may perform one or more functions described as being performed by another set of components of device 300.

[0060] Figure 3B 350. Device 350 may correspond to content collection device 210, script analysis platform 230, computing resources 234, etc. In some implementations, content collection device 210, script analysis platform 230, computing resources 234, etc. may include one or more devices 350 and / or one or more components of device 350. Figure 3B As shown in , the device 350 may include one or more input components 355-1 to 355-B (B≥1) (hereinafter collectively referred to as input component 355, and individually referred to as input component 355), a switching component 360, one or more output components 365-1 to 365-C (C≥1) (hereinafter collectively referred to as output component 365, and individually referred to as output component 365) and a controller 370.

[0061] The input component 355 can be an attachment point for a physical link and can be an entry point for incoming traffic such as packets. The input component 355 can process incoming traffic, such as by performing data link layer encapsulation or decapsulation. In some implementations, the input component 355 can send and / or receive packets. In some implementations, the input component 355 can include an input line card, which includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more interface cards (IFCs), packet forwarding components, line card controller components, input ports, processors, memory, and / or input queues. In some implementations, the device 350 can include one or more input components 355.

[0062] The switching component 360 can interconnect the input component 355 with the output component 365. In some implementations, the switching component 360 can be implemented via one or more crossbar switches, via a bus, and / or using a shared memory. The shared memory can act as a temporary buffer to store packets from the input component 355 before the packets are finally scheduled for delivery to the output component 365. In some implementations, the switching component 360 can enable the input component 355, the output component 365, and / or the controller 370 to communicate.

[0063] The output component 365 can store packets and can schedule packets for transmission on an output physical link. The output component 365 can support data link layer encapsulation or decapsulation, and / or various higher-level protocols. In some implementations, the output component 365 can send packets and / or receive packets. In some implementations, the output component 365 may include an output line card, which includes one or more packet processing components (e.g., in the form of an integrated circuit), such as one or more IFCs, packet forwarding components, line card controller components, output ports, processors, memories, and / or output queues. In some implementations, the device 350 may include one or more output components 365. In some implementations, the input component 355 and the output component 365 can be implemented by the same set of components (e.g., and the input / output component can be a combination of the input component 355 and the output component 365).

[0064] The controller 370 includes a processor in the form of, for example, a CPU, a GPU, an APU, a microprocessor, a microcontroller, a DSP, an FPGA, an ASIC, and / or another type of processor. The processor is implemented in hardware, firmware, or a combination of hardware and software. In some implementations, the controller 370 may include one or more processors that can be programmed to perform functions.

[0065] In some implementations, the controller 370 may include RAM, ROM, and / or another type of dynamic or static storage device (eg, flash memory, magnetic memory, optical memory, etc.) that stores information and / or instructions for use by the controller 370 .

[0066] In some implementations, the controller 370 can communicate with other devices, networks, and / or systems connected to the device 300 to exchange information about the network topology. The controller 370 can create a routing table based on the network topology information, create a forwarding table based on the routing table, and forward the forwarding table to the input component 355 and / or the output component 365. The input component 355 and / or the output component 365 can use the forwarding table to perform a route lookup for incoming and / or outgoing packets.

[0067] The controller 370 may perform one or more processes described herein. The controller 370 may perform these processes in response to executing software instructions stored by a non-transient computer readable medium. A computer readable medium is defined herein as a non-transient memory device. A memory device includes a memory space within a single physical storage device or a memory space distributed across multiple physical storage devices.

[0068] The software instructions may be read into a memory and / or storage component associated with the controller 370 from another computer-readable medium or from another device via a communication interface. When executed, the software instructions stored in the memory and / or storage component associated with the controller 370 may cause the controller 370 to perform one or more processes described herein. Additionally, or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, the implementations described herein are not limited to any specific combination of hardware circuitry and software.

[0069] supply Figure 3B The number and arrangement of components shown in FIG. are provided as examples. Figure 3B Device 350 may include additional components, fewer components, different components, or differently arranged components compared to those components shown in . Additionally, or alternatively, a set of components (e.g., one or more components) of device 350 may perform one or more functions described as being performed by another set of components of device 350.

[0070] Figure 4 is a flow chart of an example process 400 for behavioral detection of malicious scripts. In some implementations, Figure 4 One or more processing blocks of may be performed by a script analysis platform (e.g., script analysis platform 230). In some implementations, Figure 4One or more processing boxes can be performed by another device or a group of devices that is separate from the script analysis platform or includes the script analysis platform, such as a content collection device (e.g., content collection device 210), a computing resource (e.g., computing resource 234), a cloud computing environment (e.g., cloud computing environment 232), etc.

[0071] like Figure 4 As shown in , process 400 may include obtaining a script associated with the content, wherein the script includes one or more functions, the one or more functions including one or more expressions (block 410). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may obtain the script associated with the content. In some implementations, as described above, the script includes one or more functions, the one or more functions including one or more expressions.

[0072] like Figure 4 As further shown in FIG. 4 , process 400 may include parsing the script to generate a data structure, wherein the data structure represents the grammatical structure of the script (block 420). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may parse the script to generate a data structure. In some implementations, the data structure represents the grammatical structure of the script.

[0073] like Figure 4 As further shown in FIG. 4 , process 400 may include traversing the data structure to determine one or more functions (block 430). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse the data structure to determine one or more functions.

[0074] like Figure 4As further shown in , process 400 may include traversing a data structure based on one or more functions to determine properties of one or more expressions, wherein traversing the data structure to determine properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions contributes to determining properties of the one or more expressions (block 440). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse a data structure based on one or more functions to determine properties of the one or more expressions. In some implementations, traversing the data structure to determine properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions. In some implementations, evaluating the one or more constant subexpressions contributes to determining properties of the one or more expressions.

[0075] like Figure 4 As further shown in FIG. 4 , process 400 may include analyzing properties of one or more expressions to determine whether the script exhibits malicious behavior (block 450). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may analyze properties of one or more expressions to determine whether the script exhibits malicious behavior.

[0076] like Figure 4 As further shown in FIG. 4 , process 400 may include causing an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior (block 460). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may cause an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior.

[0077] Process 400 may include additional implementations, such as in conjunction with one or more other processes described elsewhere herein and / or any single implementation or any combination of implementations described below.

[0078] In some implementations, the constant subexpression of the one or more constant subexpressions includes at least one of a constant numeric value, a constant string value, a combination of constant numeric values ​​or constant string values, a library function call associated with a computer language of the script called with at least one parameter, the at least one parameter being a constant numeric value, a constant string value, or a combination of constant numeric values ​​or constant string values, etc. In some implementations, the script is a JavaScript script, a Visual Basic (VB) script, a Visual Basic for Applications (VBA) script, a Jscript script, a PowerShell script, etc.

[0079] In some implementations, causing an action with respect to a script or content to be performed includes causing one or more of the following based on a determination that the script exhibits malicious behavior: the content or script is deleted from a source device; the content or script is isolated on the source device to prohibit access to the content or script; a search is performed via a network for other instances of the content or script on one or more other devices and other instances to be deleted; one or more other devices are analyzed for malicious behavior; network connectivity of one or more other devices is modified, etc.

[0080] In some implementations, traversing the data structure to determine properties of the one or more expressions includes: maintaining a call stack associated with the one or more expressions; maintaining a symbol table for one or more identifiers associated with the one or more expressions; and determining the properties of the one or more expressions based on information included in the symbol table. In some implementations, for an identifier of the one or more identifiers, the symbol table includes information indicating at least one of: a type of the identifier; a scope of the identifier; a reference to an assigned value of the identifier; whether the assigned value is assigned in a loop; whether the assigned value is assigned by a non-trivial assign call; whether the identifier is self-modifying, etc.

[0081] In some implementations, the malicious behavior includes at least one of the following attributes: accessing a global object using complex array access; calling a function by evaluating a complex expression; decoding a string value; calling an evaluate or execute function by performing complex string calculations, etc.

[0082] although Figure 4 Example blocks of process 400 are shown, but in some implementations, Figure 4 Process 400 may include additional blocks, fewer blocks, different blocks, or differently arranged blocks compared to those blocks depicted in . Additionally, or alternatively, two or more blocks of process 400 may be performed in parallel.

[0083] Figure 5is a flow chart of an example process 500 for behavioral detection of malicious scripts. In some implementations, Figure 5 One or more process blocks of may be performed by a script analysis platform (e.g., script analysis platform 230). In some implementations, Figure 5 One or more process blocks may be performed by another device or a group of devices that is separate from or includes the script analysis platform, such as a content collection device (e.g., content collection device 210), a computing resource (e.g., computing resource 234), a cloud computing environment (e.g., cloud computing environment 232), etc.

[0084] like Figure 5 As shown in , process 500 may include obtaining a script associated with content from a content collection device, wherein the script includes one or more functions, and the one or more functions include one or more expressions (block 510). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may obtain a script associated with content from a content collection device. In some implementations, the script includes one or more functions, and the one or more functions include one or more expressions.

[0085] like Figure 5 As further shown in FIG. 5 , process 500 may include parsing the script to generate a data structure (block 520). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may parse the script to generate a data structure.

[0086] like Figure 5 As further shown in FIG. 5 , process 500 may include traversing the data structure to determine one or more functions (block 530). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse the data structure to determine one or more functions.

[0087] like Figure 5As further shown in , process 500 may include traversing a data structure based on one or more functions to determine one or more properties of one or more expressions, wherein traversing the data structure to determine one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, and wherein evaluating the one or more constant subexpressions contributes to determining the one or more properties of the one or more expressions (block 540). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse a data structure based on one or more functions to determine one or more properties of the one or more expressions. In some implementations, traversing the data structure to determine one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions. In some implementations, evaluating the one or more constant subexpressions contributes to determining the one or more properties of the one or more expressions.

[0088] like Figure 5 As further shown in FIG. 5 , process 500 may include obtaining information describing one or more properties of malicious behavior (block 550). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may obtain information describing one or more properties of malicious behavior.

[0089] like Figure 5 As further shown in FIG. 5 , process 500 may include analyzing one or more properties of one or more expressions based on the information to determine whether the script exhibits malicious behavior (block 560). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may analyze one or more properties of one or more expressions based on the information to determine whether the script exhibits malicious behavior.

[0090] like Figure 5As further shown in FIG. 5 , process 500 may include causing an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior (block 570). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may cause an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior.

[0091] Process 500 may include additional implementations, such as in conjunction with one or more other processes described elsewhere herein and / or any single implementation or any combination of implementations described below.

[0092] In some implementations, the data structure is an abstract syntax tree (AST). In some implementations, the malicious behavior is a self-modifying code behavior.

[0093] In some implementations, the script analysis platform, while traversing the data structure to determine one or more properties of the one or more expressions, determines one or more branches associated with the one or more expressions and traverses each branch of the one or more branches to determine the one or more properties of the one or more expressions.

[0094] In some implementations, the script analysis platform allocates a block of memory to contiguously store two or more elements of the data structure when parsing the script to generate the data structure. In some implementations, the memory associated with the two or more elements of the data structure will be deallocated through a deallocation call.

[0095] In some implementations, when analyzing one or more attributes of one or more expressions to determine whether a script exhibits malicious behavior, the script analysis platform determines, based on the information, that an attribute in the one or more attributes corresponds to at least one of one or more properties of malicious behavior, and determines that the script exhibits malicious behavior based on the attribute corresponding to at least one property of the malicious behavior.

[0096] In some implementations, when analyzing one or more attributes of one or more expressions to determine whether a script exhibits malicious behavior, the script analysis platform determines, based on the information, that the one or more attributes do not correspond to any of the one or more properties for malicious behavior, and determines that the script does not exhibit malicious behavior based on the one or more attributes that do not correspond to any properties of malicious behavior.

[0097] In some implementations, the script analysis platform, when causing an action regarding a script or content to be executed, causes the content or script to be deleted from a content collection device based on a determination that the script exhibits malicious behavior, or causes the content collection device to send the content or script to a different device based on a determination that the script does not exhibit malicious behavior.

[0098] although Figure 5 Example blocks of process 500 are shown, but in some implementations, Figure 5 Process 500 may include additional blocks, fewer blocks, different blocks, or differently arranged blocks, unlike those depicted in . Additionally or alternatively, two or more blocks of process 500 may be performed in parallel.

[0099] Figure 6 is a flow chart of an example process 600 for behavioral detection of malicious scripts. In some implementations, Figure 6 One or more process blocks of may be performed by a script analysis platform (e.g., script analysis platform 230). In some implementations, Figure 6 One or more process blocks may be performed by another device or a group of devices that is separate from or includes the script analysis platform, such as a content collection device (e.g., content collection device 210), a computing resource (e.g., computing resource 234), a cloud computing environment (e.g., cloud computing environment 232), etc.

[0100] like Figure 6 As shown in , process 600 may include obtaining a script associated with the content, wherein the script includes one or more functions, the one or more functions including one or more expressions (block 610). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may obtain the script associated with the content. In some implementations, the script includes one or more functions, the one or more functions including one or more expressions.

[0101] like Figure 6 As further shown in FIG. 6 , process 600 may include allocating blocks of memory after obtaining the script (block 620). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may allocate blocks of memory after obtaining the script.

[0102] like Figure 6As further shown in FIG. 6 , process 600 may include parsing the script to generate a data structure that may be stored in a block of memory, wherein the data structure represents a grammatical structure of at least some of the script (block 630). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may parse the script to generate a data structure that may be stored in a block of memory. In some aspects, the data structure represents a grammatical structure of at least some of the script.

[0103] like Figure 6 As further shown in FIG. 6 , process 600 may include storing the data structure in a block of memory (block 640). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may store the data structure in a block of memory.

[0104] like Figure 6 As further shown in FIG. 6 , process 600 may include traversing the data structure to determine one or more functions (block 650). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse the data structure to determine one or more functions.

[0105] like Figure 6As further shown in , process 600 may include traversing a data structure based on one or more functions to determine one or more properties of one or more expressions, wherein traversing the data structure to determine one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions, and wherein evaluating the one or more constant subexpressions contributes to determining the properties of the one or more expressions (block 660). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may traverse a data structure based on one or more functions to determine one or more properties of the one or more expressions. In some implementations, traversing the data structure to determine one or more properties of the one or more expressions includes evaluating one or more constant subexpressions of the one or more expressions. In some implementations, evaluating the one or more constant subexpressions contributes to determining the one or more properties of the one or more expressions.

[0106] like Figure 6 As further shown in FIG. 6 , process 600 may include analyzing one or more properties of one or more expressions to determine whether the script exhibits malicious behavior (block 670). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 370, etc.) may analyze one or more properties of one or more expressions to determine whether the script exhibits malicious behavior.

[0107] like Figure 6 As further shown in FIG. 6 , process 600 may include causing an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior (block 680). For example, as described above, the script analysis platform (e.g., using computing resources 234, processor 310, memory 315, storage component 320, input component 325, output component 330, communication interface 335, input component 355, switching component 360, output component 365, controller 700, etc.) may cause an action to be performed with respect to the script or content based on determining whether the script exhibits malicious behavior.

[0108] Process 600 may include additional implementations, such as in conjunction with one or more other processes described elsewhere herein and / or any single implementation or any combination of implementations described below.

[0109] In some implementations, when obtaining the script, the script analysis platform receives the script from the source device. In some implementations, the source device has removed the script from the content.

[0110] In some implementations, when causing an action with respect to the script or the content to be performed, the script analysis platform causes the source device to send the content and the script to a different device based on determining that the script does not exhibit malicious behavior.

[0111] In some implementations, one or more attributes of one or more expressions are included in one or more symbol tables, and the script analysis platform searches the one or more symbol tables for an attribute in the one or more attributes that corresponds to the nature of the malicious behavior when analyzing the attributes of the one or more expressions to determine whether the script exhibits malicious behavior.

[0112] In some implementations, when analyzing one or more attributes of one or more expressions to determine whether a script exhibits malicious behavior, the script analysis platform identifies a set of attributes in the one or more attributes and analyzes the set of attributes to determine whether the set of attributes exhibits malicious behavior. In some implementations, each attribute of the set of attributes corresponds to one or more properties of malicious behavior.

[0113] although Figure 6 Example blocks of process 600 are shown, but in some implementations, Figure 6 Unlike those blocks depicted in , process 600 may include additional blocks, fewer blocks, different blocks, or differently arranged blocks. Additionally or alternatively, two or more blocks of process 600 may be performed in parallel.

[0114] According to some implementations, Example 1: A method, comprising: obtaining, by a device, a script associated with content, wherein the script includes one or more functions, and the one or more functions include one or more expressions; parsing, by the device, the script to generate a data structure, wherein the data structure represents a grammatical structure of the script; traversing, by the device, the data structure to determine one or more functions; traversing, by the device based on the one or more functions, the data structure to determine properties of one or more expressions, wherein traversing the data structure based on the one or more functions includes evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps to determine properties of the one or more expressions; analyzing, by the device, the properties of the one or more expressions to determine whether the script exhibits malicious behavior; and causing an action regarding the script or content to be performed based on determining whether the script exhibits malicious behavior.

[0115] According to some implementations, Example 2: According to the method of Example 1, wherein the constant subexpression of one or more constant subexpressions includes at least one of the following: a constant numeric value; a constant string value; a combination of constant numeric values ​​or constant string values; or a library function call associated with the computer language of the script, the script calling with at least one parameter, at least one parameter is a constant numeric value, a constant string value, or a combination of constant numeric values ​​or constant string values.

[0116] According to some implementations, Example 3: The method of Example 1, wherein the script is: a JavaScript script, a Visual Basic (VB) script, a Visual Basic for Applications (VBA) script, a Jscript script, or a PowerShell script.

[0117] According to some implementations, Example 4: According to a method of Example 1, wherein causing an action regarding a script or content to be performed includes: causing one or more of the following based on determining that the script exhibits malicious behavior: the content or script is deleted from a source device; the content or script is isolated at the source device to prohibit access to the content or script; a search is performed via a network for other instances of the content or script on one or more other devices and other instances to be deleted; one or more other devices are analyzed for malicious behavior; or modification of network connectivity of one or more other devices.

[0118] According to some implementations, Example 5: A method according to Example 1, wherein traversing a data structure to determine properties of one or more expressions includes: maintaining a call stack associated with the one or more expressions; maintaining a symbol table for one or more identifiers associated with the one or more expressions; and determining the properties of the one or more expressions based on information included in the symbol table.

[0119] According to some implementations, Example 6: A method according to Example 5, wherein for an identifier of one or more identifiers, the symbol table includes information indicating at least one of: the type of the identifier; the scope of the identifier; a reference to an assigned value of the identifier; whether the assigned value is assigned in a loop; whether the assigned value is assigned through a non-trivial assign call; or whether the identifier is self-modifying.

[0120] According to some implementations, Example 7: A method according to Example 1, wherein the malicious behavior includes at least one of the following properties: accessing a global object using complex array access; calling a function by calculating a complex expression; decoding a string value; or calling an evaluation or execution function by performing complex string calculations.

[0121] According to some implementations, Example 8: A device comprising: one or more memories; and one or more processors for: obtaining a script associated with content from a content collection device, wherein the script comprises one or more functions, and the one or more functions comprise one or more expressions; parsing the script to generate a data structure; traversing the data structure to determine the one or more functions; based on the one or more functions, traversing the data structure to determine one or more properties of the one or more expressions, wherein traversing the data structure based on the one or more functions comprises evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps determine one or more properties of the one or more expressions; obtaining information describing one or more properties of malicious behavior; based on the information, analyzing one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior; and based on determining whether the script exhibits malicious behavior, causing an action regarding the script or content to be performed.

[0122] According to some implementations, Example 9: The device of Example 8, wherein the data structure is an abstract syntax tree (AST).

[0123] According to some implementations, Example 10: The device of Example 8, wherein the malicious behavior is self-modifying code behavior.

[0124] According to some implementations, Example 11: A device according to Example 8, wherein one or more processors, when traversing a data structure to determine one or more attributes of one or more expressions, are used to: determine one or more branches associated with one or more expressions; and traverse each branch of the one or more branches to determine one or more attributes of the one or more expressions.

[0125] According to some implementations, Example 12: A device according to Example 8, wherein one or more processors, when parsing a script to generate a data structure, are used to: allocate a block of memory to contiguously store two or more elements of the data structure, wherein the memory associated with the two or more elements of the data structure will be deallocated via a deallocation call.

[0126] According to some implementations, Example 13: A device according to Example 8, wherein one or more processors, when analyzing one or more attributes of one or more expressions to determine whether a script exhibits malicious behavior, are used to: determine, based on information, that an attribute in the one or more attributes corresponds to at least one of one or more properties of malicious behavior; and determine that the script exhibits malicious behavior based on the attribute corresponding to at least one property of the malicious behavior.

[0127] According to some implementations, Example 14: A device according to Example 8, wherein one or more processors, when analyzing one or more properties of one or more expressions to determine whether a script exhibits malicious behavior, are used to: determine, based on the information, that the one or more properties do not correspond to any of one or more properties of malicious behavior; and determine that the script does not exhibit malicious behavior based on the one or more properties that do not correspond to any properties of malicious behavior.

[0128] According to some implementations, Example 15: A device according to Example 8, wherein one or more processors, when causing an action regarding a script or content to be executed, are used to: cause the content or script to be deleted from a content collection device based on a determination that the script exhibits malicious behavior; or cause the content collection device to send the content or script to a different device based on a determination that the script does not exhibit malicious behavior.

[0129] According to some implementations, Example 16: A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions, which, when executed by one or more processors, cause the one or more processors to: obtain a script associated with content, wherein the script comprises one or more functions, and the one or more functions comprise one or more expressions; after obtaining the script, allocate a block of memory; parse the script to generate a data structure capable of being stored in the block of memory, wherein the data structure represents a grammatical structure of at least some of the script; store the data structure in the block of memory; traverse the data structure to determine one or more functions; based on the one or more functions, traverse the data structure to determine one or more properties of the one or more expressions, wherein traversing the data structure based on the one or more functions comprises evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions helps determine one or more properties of the one or more expressions; analyze one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior; and based on determining whether the script exhibits malicious behavior, cause an action regarding the script or content to be performed.

[0130] According to some implementations, Example 17: The non-transitory computer-readable medium of Example 16, wherein the one or more instructions that cause the one or more processors to obtain the script cause the one or more processors to: receive the script from a source device, wherein the source device has removed the script from the content.

[0131] According to some implementations, Example 18: A non-transitory computer-readable medium according to Example 16, wherein one or more instructions that cause one or more processors to cause an action regarding a script or content to be performed cause the one or more processors to: based on determining that the script does not exhibit malicious behavior, cause the source device to send the content and the script to a different device.

[0132] According to some implementations, Example 19: A non-transitory computer-readable medium according to Example 16, wherein one or more attributes of one or more expressions are included in one or more symbol tables, wherein one or more instructions that cause one or more processors to analyze the attributes of the one or more expressions to determine whether a script exhibits malicious behavior cause the one or more processors to: search the one or more symbol tables for an attribute in the one or more attributes that corresponds to the nature of the malicious behavior.

[0133] According to some implementations, Example 20: Non-transitory computer-readable medium according to Example 16, wherein one or more instructions that cause one or more processors to analyze properties of one or more expressions to determine whether a script exhibits malicious behavior cause the one or more processors to: identify a property set of one or more properties, wherein each property of the property set corresponds to one or more properties of malicious behavior; and analyze the property set to determine whether the property set exhibits malicious behavior.

[0134] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the implementations to the precise forms disclosed. Modifications and variations may be made in light of the above disclosure or may be acquired from practice of the implementations.

[0135] As used herein, "traffic" or "content" may include a collection of packets. A "packet" may refer to a communication structure for conveying information, such as a protocol data unit (PDU), a network packet, a datagram, a segment, a message, a block, a cell, a frame, a subframe, a timeslot, a symbol, any portion of the above, and / or another type of formatted or unformatted data unit capable of being transmitted via a network.

[0136] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, and / or a combination of hardware and software.

[0137] As used herein, satisfying a threshold may refer to a value being greater than a threshold, more than a threshold, above a threshold, greater than or equal to a threshold, less than a threshold, less than a threshold, below a threshold, less than or equal to a threshold, equal to a threshold, etc., depending on the context.

[0138] It is apparent that the systems and / or methods described herein may be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software code - it should be understood that software and hardware can be designed to implement the systems and / or methods described herein.

[0139] Even though particular combinations of features are stated in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of the various implementations. In fact, many of these features may be combined in ways not specifically stated in the claims and / or disclosed in the specification. Although each of the dependent claims listed below may directly depend on only one claim, the disclosure of the various implementations includes each dependent claim in combination with every other claim in the claim set.

[0140] Unless explicitly described as such, the elements, actions or instructions used herein should not be interpreted as critical or essential. Moreover, as used herein, the articles "one" and "an" are intended to include one or more items and can be used interchangeably with "one or more". In addition, as used herein, the term "set" is intended to include one or more items (e.g., related items, unrelated items, combinations of related items and unrelated items, etc.), and can be used interchangeably with "one or more". In the case of only one item expected, the phrase "only one" or similar language is used. Moreover, as used herein, the term "has, have, having" etc. is intended to be an open term. In addition, unless otherwise expressly stated, the phrase "based on" is intended to mean "based at least in part on".

Claims

1. A method comprising: The device retrieves the script associated with the content, wherein the script comprises one or more functions, and the one or more functions comprises one or more expressions; parsing the script by the device to generate a data structure, wherein the data structure represents the grammatical structure of the script; traversing, by the device, the data structure to determine the one or more functions; traversing the data structure by the device based on the one or more functions to determine properties of the one or more expressions, wherein a symbol table is maintained for identifiers associated with the one or more expressions, and wherein traversing the data structure based on the one or more functions comprises evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions facilitates determining the property of the one or more expressions, and wherein evaluating the one or more constant subexpressions is performed by updating the symbol table to indicate a value of the identifier; analyzing, by the device, the properties of the one or more expressions to determine whether the script exhibits malicious behavior, Wherein analyzing the properties of the one or more expressions comprises: parsing a description file describing one or more attributes associated with malicious behavior, The description file includes whether the attributes that are typically associated with malicious behavior are not associated with malicious behavior; as well as An action is caused by the device to be performed with respect to the script or the content based on determining whether the script exhibits malicious behavior.

2. The method of claim 1 , wherein the constant subexpression of the one or more constant subexpressions comprises at least one of the following: Constant value; Constant string value; A combination of constant numeric or constant string values; or A library function call associated with the computer language of the script is called by the script with at least one parameter, the at least one parameter being a constant numeric value, a constant string value, or a combination of constant numeric values ​​or constant string values.

3. The method of claim 1, wherein the script is: JavaScript scripts, Visual Basic (VB) script, VisualBasic for Applications (VBA) script, Jscript, or PowerShell script.

4. The method of claim 1 , wherein causing the action with respect to the script or the content to be performed comprises: Based on determining that the script exhibits malicious behavior, causing one or more of the following: The content or the script is deleted from the source device; The content or the script is isolated at the source device to prohibit access to the content or the script; A search is performed via the network for other instances of the content or the script on one or more other devices and other instances to be deleted; The one or more other devices are analyzed for the malicious behavior; or A modification of network connectivity to the one or more other devices.

5. The method of claim 1 , wherein traversing the data structure to determine the properties of the one or more expressions comprises: maintaining a call stack associated with the one or more expressions; maintaining the symbol table; as well as The attributes of the one or more expressions are determined based on information included in the symbol table.

6. The method of claim 5, wherein the symbol table includes information indicating at least one of: the scope of the identifier; or A reference to the assigned value for the identifier.

7. The method of claim 1, wherein the malicious behavior comprises at least one of the following properties: Use complex array access to access global objects; Calling functions by evaluating complex expressions; decode a string value; or Calling the evaluate or execute function by performing complex string calculations.

8. A device comprising: one or more memories; as well as One or more processors to: obtaining a script associated with the content from a content collection device, wherein the script comprises one or more functions, and the one or more functions comprises one or more expressions; parsing the script to generate a data structure; traversing the data structure to determine the one or more functions; Based on the one or more functions, traversing the data structure to determine one or more properties of the one or more expressions, wherein a symbol table is maintained for identifiers associated with the one or more expressions, and wherein traversing the data structure based on the one or more functions comprises evaluating one or more constant subexpressions of the one or more expressions, wherein the one or more constant subexpressions are evaluated by updating the symbol table to indicate a value of the identifier rather than a reference to the value of the identifier; wherein evaluating the one or more constant subexpressions facilitates determining the one or more properties of the one or more expressions; Obtain information describing one or more properties of the malicious conduct; Based on the information, analyzing the one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior; as well as Based on determining whether the script exhibits malicious behavior, an action is performed with respect to the script or the content.

9. The apparatus of claim 8, wherein the data structure is an abstract syntax tree (AST).

10. The apparatus of claim 8, wherein the malicious behavior is a self-modifying code behavior.

11. The apparatus of claim 8, wherein the one or more processors, when traversing the data structure to determine the one or more attributes of the one or more expressions, are to: determining one or more branches associated with the one or more expressions; and Each branch of the one or more branches is traversed to determine the one or more properties of the one or more expressions.

12. The apparatus of claim 8, wherein the one or more processors, when parsing the script to generate the data structure, are configured to: allocating a block of memory to contiguously store two or more elements of the data structure, Wherein memory associated with the two or more elements of the data structure is to be deallocated via a deallocation call.

13. The apparatus of claim 8, wherein the one or more processors, when analyzing the one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior, are to: Based on the information, determining that an attribute of the one or more attributes corresponds to at least one of the one or more properties of malicious behavior; and Based on the attribute corresponding to the at least one property of malicious behavior, it is determined that the script exhibits malicious behavior.

14. The apparatus of claim 8, wherein the one or more processors, when analyzing the one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior, are to: Based on the information, determining that the one or more attributes do not correspond to any of the one or more properties of malicious behavior; and Based on the one or more attributes not corresponding to any properties of malicious behavior, it is determined that the script does not exhibit malicious behavior.

15. The apparatus of claim 8, wherein the one or more processors, when causing the action with respect to the script or the content to be performed, are to: Based on a determination that the script exhibits malicious behavior, causing the content or script to be deleted from the content collection device; or Based on determining that the script does not exhibit malicious behavior, the content collection device is caused to send the content or the script to a different device.

16. A non-transitory computer-readable medium storing instructions, the instructions comprising: One or more instructions that, when executed by one or more processors, cause the one or more processors to: Get the script associated with the content, wherein the script comprises one or more functions, and the one or more functions comprises one or more expressions; After obtaining the script, allocating a block of memory; parsing the script to generate a data structure capable of being stored in a block of the memory, wherein said data structure represents a grammatical structure of at least some of said scripts; storing the data structure in a block of the memory; traversing the data structure to determine the one or more functions; traversing the data structure to determine the one or more properties of the one or more expressions based on the one or more functions, wherein a symbol table is maintained for identifiers associated with the one or more expressions, and wherein traversing the data structure based on the one or more functions comprises evaluating one or more constant subexpressions of the one or more expressions, wherein evaluating the one or more constant subexpressions facilitates determining the one or more properties of the one or more expressions; analyzing the one or more properties of the one or more expressions to determine whether the script exhibits malicious behavior; wherein the one or more instructions that cause the one or more processors to analyze the properties of the one or more expressions cause the one or more processors to: parsing a description file describing one or more attributes associated with malicious behavior, The description file includes whether attributes that are typically associated with malicious behavior are not associated with malicious behavior; and Based on determining whether the script exhibits malicious behavior, an action is performed with respect to the script or the content.

17. The non-transitory computer readable medium of claim 16, wherein the one or more instructions that cause the one or more processors to obtain the script cause the one or more processors to: receiving the script from a source device, The source device has removed the script from the content.

18. The non-transitory computer-readable medium of claim 16, wherein the one or more instructions that cause the one or more processors to cause the action with respect to the script or the content to be performed cause the one or more processors to: Based on determining that the script does not exhibit malicious behavior, the source device is caused to send the content and the script to a different device.

19. The non-transitory computer-readable medium of claim 16, wherein the one or more instructions that cause the one or more processors to analyze the properties of the one or more expressions to determine whether the script exhibits malicious behavior cause the one or more processors to: The symbol table is searched for an attribute of the one or more attributes that corresponds to a nature of the malicious behavior.

20. The non-transitory computer-readable medium of claim 16, wherein the one or more instructions that cause the one or more processors to analyze the properties of the one or more expressions to determine whether the script exhibits malicious behavior cause the one or more processors to: an attribute set identifying the one or more attributes, wherein each attribute of the set of attributes corresponds to one or more properties of malicious behavior; and The set of attributes is analyzed to determine whether the set of attributes exhibits malicious behavior.

Images