Browser Context Malware Detection via Instrumented VM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection techniques are evaded by nefarious authors through cloaking and other evasion methods, making it difficult to identify and mitigate web-based malware effectively.
Innovation Solution
A hybrid scanning environment is implemented using a client device with a browser extension and a remote scanner, where the browser extension establishes a socket connection to an instrumented virtual machine environment, allowing for dynamic malware analysis and detection by executing and rendering web content in a controlled environment, thereby avoiding evasion techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malware detection techniques are used, then detection simplicity is maintained, but detection accuracy deteriorates due to evasion methods
Solution Approach 1:
The patent introduces an intermediary instrumented browser environment that acts as a mediator between the malware author's server and the victim's browser. This intermediate environment executes JavaScript code and generates browser context data that reveals malicious behavior patterns, thereby improving detection accuracy without requiring direct analysis of the malware itself.
Solution Approach 2:
The patent transitions from traditional signature-based detection to a new dimension of analysis by capturing and analyzing browser context data, including DOM structure, JavaScript execution state, and rendering behavior. This dimensional shift allows detection of malicious intent through behavioral patterns rather than static code analysis.
2Reliability
If browser context analysis is implemented, then malware detection capability is improved, but system complexity increases
Solution Approach 1:
The patent segments the malware detection system into distinct components: a malware author's server environment, an instrumented browser execution environment, and an analysis system. Each segment performs a specific function - the instrumented browser captures execution context, while the analysis system processes the captured data to identify malicious patterns, thereby managing complexity through functional decomposition.
Solution Approach 2:
The patent creates a copied representation of the browser execution environment that includes instrumented versions of browser components. This copied environment mimics real browser behavior while capturing additional diagnostic data about JavaScript execution and DOM manipulation, enabling reliable malware detection through behavioral analysis without affecting the actual browser.
3Measurement precision
If dynamic code execution is performed, then evasion detection is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary actions by pre-instrumenting the browser environment with monitoring code before malware execution. The instrumented browser is prepared in advance to capture specific events such as DOM mutations, JavaScript errors, and resource loading patterns, enabling efficient analysis of malware behavior without requiring complex real-time processing during execution.
Data Source
AI summary
The use of browser context in detecting malware is disclosed. A client device requests content from a remote server. Data received by the client device from the remote server is transmitted to an external scanner for analysis by the external scanner. The external scanner is configured to use a browser executed in an instrumented virtual machine environment to analyze the data provided by the client device. The client device is configured to request the content from the remote server using a browser extension configured to retrieve data and provide the retrieved data to the external scanner without rendering the retrieved data.