Browser Extension Hidden Behavior Detection via Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect hidden behavior in browser extensions, which can be malicious, due to their complex file structures and obfuscated code, making it difficult to determine their full functionality and potential malicious actions.
Innovation Solution
A method is developed to analyze browser extensions as a unified object by simulating user actions in a protected environment, registering and analyzing events, and identifying changes indicative of hidden behavior, thereby revealing and determining malicious actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If static analysis of individual extension files is performed, then analysis speed is improved, but detection accuracy of hidden behavior deteriorates
Solution Approach 1:
The analysis system segments the extension analysis into multiple phases: static analysis of individual files is performed first for quick screening, then dynamic analysis is conducted on suspicious components. This segmentation allows the system to maintain high overall analysis speed while achieving high detection accuracy through targeted deep analysis of specific files that show suspicious characteristics in the static phase.
Solution Approach 2:
Instead of performing exhaustive dynamic analysis on all extension files (which would be too slow), the system performs partial analysis selectively. Static analysis is used to identify files with suspicious characteristics, and only those files undergo more intensive dynamic analysis. This partial action approach maintains speed while improving detection accuracy where it matters most.
2Measurement precision
If dynamic analysis with user activity simulation is performed, then detection accuracy of hidden behavior is improved, but analysis time increases
Solution Approach 1:
The system performs preliminary static analysis on all extension files before conducting dynamic analysis. This preliminary action identifies files with suspicious characteristics (such as obfuscated code, unusual permissions, or suspicious file structures), allowing the dynamic analysis phase to focus only on these targeted files. This significantly reduces the overall analysis time while maintaining high detection accuracy for malicious behaviors.
Solution Approach 2:
Dynamic analysis with user activity simulation is applied selectively only to files that exhibit suspicious characteristics during static analysis, rather than to all extension files. This partial application of the time-consuming dynamic analysis technique reduces overall analysis time while maintaining high detection accuracy for the most suspicious components.
3Loss of information
If code obfuscation techniques are used by extensions, then functionality concealment is improved, but analysis difficulty increases
Solution Approach 1:
The system replaces traditional static code analysis methods with dynamic execution-based analysis. Instead of attempting to decode obfuscated code statically, the system executes the extension in a controlled virtualized environment and observes its actual runtime behavior. This substitution of analysis methodology allows the system to detect hidden functionalities regardless of code obfuscation techniques, as the actual execution reveals the true behavior.
Solution Approach 2:
A virtualized execution environment acts as an intermediary between the malicious extension and the analysis system. This intermediary environment safely executes the obfuscated code and captures its runtime behavior, including file system operations, network communications, and registry modifications. The intermediary translates the obfuscated code's hidden intentions into observable actions that can be analyzed and detected.
4Measurement precision
If comprehensive analysis of all extension files is performed, then detection completeness is improved, but computational resources consumed increases
Solution Approach 1:
The analysis process is segmented into multiple stages with increasing resource investment: Stage 1 performs lightweight static analysis on all files, Stage 2 performs targeted analysis on suspicious files identified in Stage 1, and Stage 3 performs intensive dynamic analysis only on the most suspicious components. This segmentation ensures comprehensive detection coverage while optimizing resource consumption by applying heavy analysis only where necessary.
Solution Approach 2:
Comprehensive analysis resources are applied partially and selectively rather than uniformly to all files. The system performs exhaustive analysis only on files that exhibit suspicious characteristics, while applying lighter analysis to the majority of benign files. This partial application of comprehensive analysis resources achieves high detection completeness for malicious files while maintaining reasonable overall resource consumption.
Data Source
Figure 1a~1b
Figure 2
Figure 3
AI summary
The present disclosure is directed towards systems and methods for detecting hidden behavior in browser extensions. In one example, a method is provided comprising launching a browser in a protected environment, performing one or more actions in the browser, tracking events occurring during the performing of the one or more actions, identifying extension events from the events that are initiated by a browser extension, analyzing the extension events for indications of change that correspond to behavior not previously declared by the browser extension, and determining that the browser extension is performing hidden behavior when indications of change are found.