Phishing Campaign Correlation via AST Obfuscation Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malicious code analysis techniques are limited in detecting and correlating obfuscated phishing campaigns, as they often rely on language-dependent approaches and are ineffective against packed malicious code.
Innovation Solution
The method involves building an abstract syntax tree from source code, decloaking it to remove payload data, and comparing the resulting obfuscation pattern to predetermined patterns to correlate phishing campaigns based on shared modus operandi.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If packed malicious code is used, then detection difficulty increases, but code functionality is preserved
Solution Approach 1:
The patent applies preliminary action by performing static analysis and de-obfuscation on packed malicious code before execution. The system builds abstract syntax trees, identifies packing functions, and extracts obfuscation patterns in advance, allowing detection to occur prior to runtime execution while preserving the ability to analyze the code's true functionality.
Solution Approach 2:
The patent uses an intermediary approach by introducing abstract syntax trees as a mediating representation between the packed code and the detection system. The AST serves as an intermediate layer that allows analysis of code structure and data flow without requiring execution, bridging the gap between obfuscated code and detectable patterns.
2Use of energy by moving object
If static analysis is used, then code execution is avoided, but detection accuracy decreases
Solution Approach 1:
The patent applies partial action by performing selective static analysis focused on specific aspects of the code such as building abstract syntax trees, identifying packing functions, and analyzing data flow. Rather than attempting complete code understanding without execution, the system performs targeted analysis on critical portions of the code to achieve sufficient detection accuracy while avoiding full execution.
Solution Approach 2:
The patent changes parameters by transforming the code representation from raw binary/packed format to abstract syntax tree structure. This parameter change in representation enables static analysis tools to extract meaningful information about code behavior and obfuscation patterns without requiring execution, improving detection accuracy while maintaining the benefits of static analysis.
3Device complexity
If language-dependent approaches are used, then analysis simplicity increases, but applicability to multiple languages decreases
Solution Approach 1:
The patent applies universality by designing a language-agnostic analysis framework that works across multiple programming languages. The system uses abstract syntax trees and data flow analysis techniques that can be applied to different language types, making the detection system versatile and adaptable to various coding languages while maintaining reasonable analysis complexity through standardized approaches.
Data Source
AI summary
Aspects of the invention include techniques for correlating distinct phishing campaigns by identifying shared modus operandi. A non-limiting example method includes building, from a source code, an abstract syntax tree and building, from the abstract syntax tree, a decloaked abstract syntax tree. The method includes removing payload data from the decloaked abstract syntax tree to define an obfuscation pattern. The obfuscation pattern is compared to a plurality of predetermined obfuscation patterns. The method includes correlating, based on the comparison, the source code to one or more phishing kits.