Applet Runtime Behavior Sequencing for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious behaviors of applets suffer from low accuracy as they primarily focus on static code analysis, failing to detect malicious behaviors that manifest through multiple consecutive invocations of service interfaces.
Innovation Solution
A method and apparatus that analyze behavior records generated during applet execution, forming feature combinations from these records to identify predetermined patterns indicative of malicious activity, including service interface names, timing, and parameter information to enhance detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static code analysis is performed on applet, then detection process is simple, but detection accuracy is low
Solution Approach 1:
The patent transitions from static code analysis to dynamic behavior analysis by monitoring service interface invocations during applet execution. The system captures real-time behavior records including interface names, parameters, and invocation sequences, enabling detection of malicious patterns that only manifest during runtime.
Solution Approach 2:
The patent adds a temporal dimension to detection by analyzing sequences of service interface invocations over time. Instead of examining code in isolation, the system constructs behavior records that capture the chronological order and relationships between multiple interface calls, revealing malicious patterns across multiple dimensions (interface name, parameters, sequence).
2Measurement precision
If behavior records of multiple service interfaces are analyzed, then detection accuracy improves, but analysis complexity increases
Solution Approach 1:
The patent segments the complex behavior analysis task into manageable components: (1) capturing individual service interface invocation events, (2) structuring them into standardized behavior records with specific fields (interface name, parameters, sequence number), and (3) analyzing sequences of these structured records. This segmentation makes the analysis process systematic and tractable.
Solution Approach 2:
The patent introduces behavior records as an intermediary data structure between the complex applet execution environment and the detection analysis process. These records standardize and simplify the representation of service interface behaviors, making them easier to analyze while preserving essential information about invocation sequences and parameters.
3Reliability
If sequential behavior patterns are monitored, then malicious behavior detection improves, but data processing volume increases
Solution Approach 1:
The patent extracts only the essential and relevant features from the complete behavior data, focusing on service interface names, key parameters, and invocation sequences. By filtering out redundant information and concentrating on critical behavioral patterns, the system achieves reliable malicious behavior detection while managing data processing volume efficiently.
Data Source
Figure 1~2
Figure 3~5
Figure 6~7
AI summary
Some embodiments of this specification provide a method and an apparatus for detecting a malicious behavior of an applet. According to the method in some embodiments, first, at least two behavior records that are generated through triggering during running of the applet are obtained; then, a behavior feature of each behavior record is extracted; next, at least one feature combination is formed by using at least two behavior features of at least two successively generated behavior records, where each feature combination includes at least two behavior features, and a sequence of the at least two behavior features in the feature combination is the same as a time sequence of generating behavior records corresponding to the at least two behavior features; and finally, it is determined whether there is a feature combination that includes a predetermined feature combination of a malicious behavior record; and if there is a feature combination that includes the predetermined feature combination of a malicious behavior record, it is determined that the applet conducts a malicious behavior.