Browser Emulator Code Analysis for Drive-by Download Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious code in drive-by download attacks are ineffective when the client environment in the browser emulator differs from the target environment, leading to difficulties in reaching the attack URL and detecting malicious code.
Innovation Solution
An analysis device that performs syntax analysis to search for transfer codes and content acquisition codes in web content, specifying objects and functions used in these codes, and extracts code dependencies using program slicing techniques to identify URLs likely to be attack or stepping-stone URLs based on client environment-specific conditions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a browser emulator is used to detect malicious code by monitoring code execution, then malicious code detection capability is improved, but detection effectiveness deteriorates when the client environment in the emulator differs from the target environment
Solution Approach 1:
The patent segments the code analysis into two distinct phases: static analysis (extracting transfer codes and content acquisition codes without execution) and dynamic analysis (monitoring actual code execution). This segmentation allows the system to adapt to different environments by performing environment-independent static analysis first, then supplementing with environment-specific dynamic analysis when needed, thereby resolving the contradiction between detection reliability and environment adaptability.
Solution Approach 2:
The patent performs preliminary static analysis to extract transfer codes and content acquisition codes before actual code execution. This preliminary action identifies potential malicious patterns and URLs without requiring a specific client environment, enabling the system to prepare detection rules in advance that can then be applied across different environments, thus improving both detection capability and environment compatibility.
2Measurement precision
If code analysis is performed based on client environment information, then detection accuracy for environment-specific attacks is improved, but analysis complexity increases
Solution Approach 1:
The patent divides the analysis system into two independent modules: a static analysis module that extracts transfer codes and content acquisition codes without considering client environment, and a dynamic analysis module that monitors execution based on actual environment. This segmentation reduces overall analysis complexity by handling environment-independent and environment-specific aspects separately, while maintaining high detection accuracy through the combination of both modules.
Solution Approach 2:
The patent introduces an intermediary mechanism that captures transfer codes and content acquisition codes during static analysis, which then serve as inputs for subsequent dynamic analysis. This intermediary layer decouples the complexity of environment-specific analysis from the core detection logic, allowing the system to maintain simplicity in the static analysis phase while achieving high accuracy through the intermediary's environment-aware dynamic analysis.
3Productivity
If traditional signature-based detection is used, then detection speed is improved, but detection coverage deteriorates for environment-dependent attacks
Solution Approach 1:
The patent performs preliminary static analysis to extract transfer codes and content acquisition codes before dynamic execution monitoring. This preliminary extraction creates a foundation of potential malicious patterns that can be quickly identified, maintaining detection speed, while the subsequent dynamic analysis based on actual client environment ensures comprehensive coverage of environment-dependent attacks, resolving the contradiction between speed and coverage.
Solution Approach 2:
The patent transitions from purely static signature-based detection to a dynamic approach that combines static code extraction with runtime execution monitoring. The system dynamically adapts detection based on actual client environment information, allowing it to maintain the speed benefits of signature matching while achieving the coverage of environment-aware detection by adjusting analysis depth and methods based on runtime conditions.
Data Source
AI summary
A program analysis unit of a browser emulator manager exhaustively searches a code by performing syntax analysis of a code included in web content to search a transfer code to another site or a content acquisition code, and specifies at least any of an object and a function and a property of the object used in the code found as a result of the search. Further, the program analysis unit extracts a code having a dependence relationship with the transfer code or the content acquisition code based on at least any of the object and the function and the property of the object thus specified.