Browser Exploit Detection via Injected Script API Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions face challenges in detecting and blocking browser exploits, particularly advanced persistent threats (APTs) that can evade detection for an extended period due to their dynamic and obfuscated nature, and existing methods like signature-based detection and host-based intrusion prevention systems can impact performance and are not effective in all cases.
Innovation Solution
A system and method that uses injected JavaScript code to hook into commonly used APIs by browser exploit writers, allowing for runtime detection and correlation of behaviors to identify malicious activity without the need for an agent on the endpoint device, thereby providing a generic and reliable detection mechanism with minimal performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection or host-based intrusion prevention systems are used to detect browser exploits, then detection capability is improved, but device complexity and performance impact worsen
Solution Approach 1:
The patent introduces an intermediary detection mechanism that injects a monitoring script into the web page content delivered to the browser. This script acts as a mediator between the exploit code and the detection system, hooking into JavaScript APIs to monitor function calls without requiring complex host-based intrusion prevention systems. The monitoring script captures API calls and their parameters, enabling exploit detection through behavioral analysis rather than complex signature matching.
2Reliability
If host-based intrusion prevention systems are deployed to block exploits, then security reliability is improved, but performance of the endpoint device deteriorates
Solution Approach 1:
The patent extracts the detection functionality from the endpoint device by implementing the monitoring script within the web page content itself. Instead of running complex detection agents on the endpoint, the detection logic is embedded in the HTML/JavaScript that the browser already executes. This extraction moves the computational burden from the endpoint device to the web server, improving device performance while maintaining security reliability.
3Measurement precision
If traditional detection methods are used to identify browser exploits, then detection accuracy is improved for known threats, but adaptability to new and obfuscated exploits worsens
Solution Approach 1:
The patent implements dynamic detection by monitoring the actual runtime behavior of JavaScript code through API call hooking. Instead of relying on static signatures that must be updated for new threats, the system dynamically observes function calls, parameters, and execution patterns during browser runtime. This dynamic approach enables the system to detect both known and previously unseen exploits, including obfuscated code, by analyzing behavioral patterns rather than fixed characteristics.
Data Source
AI summary
A computing apparatus, including: a processor and a memory; a web browser; and a web exploit mitigation engine, including instructions within the memory to instruct the processor to: insert a script into an incoming webpage, the script including instructions to hook application programming interface (API) function calls of a scripting language, the API function calls for a plurality of functions commonly used by browser exploits; observe information passed by a running script to the plurality of API functions; correlate the called API functions to a malware model; detect a web page making the API function calls as containing a browser exploit according to the correlating; and act on the detecting.