Browser Hook Code for Malicious Site Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious sites are inadequate in identifying newly created or unknown malicious programs, as they rely solely on pattern recognition and similarity inspection, failing to detect previously unknown threats.
Innovation Solution
A malicious site detection apparatus and method that monitors process execution in a computing device, inserts hook codes to inspect the stack structure and certificate presence, determining the normality or abnormality of the process to identify malicious sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern recognition and similarity inspection are used to detect malicious sites, then known malicious patterns can be identified, but newly created or unknown malicious programs cannot be detected
Solution Approach 1:
The patent performs preliminary actions by inserting hook codes into browser processes before malicious activity can occur. The hook codes preemptively monitor and inspect process execution, stack structures, and certificate validity, enabling detection of unknown malicious programs before they can execute their harmful payload.
Solution Approach 2:
The patent introduces an intermediary monitoring system that sits between the browser and the malicious content. The hook codes act as intermediaries that intercept and analyze process executions, stack structures, and certificate information, allowing detection of malicious activity without directly exposing the system to threats.
2Reliability
If real-time inspection of websites is performed to block malicious codes, then incoming malicious paths can be blocked, but the system complexity increases
Solution Approach 1:
The monitoring system performs self-service by automatically injecting hook codes into browser processes and autonomously analyzing process executions, stack structures, and certificate validity. The system monitors itself and detects malicious activity without requiring external intervention, maintaining high security while managing complexity through automation.
3Measurement precision
If hook codes are inserted to monitor process execution and inspect stack structures, then malicious sites can be detected, but the processing time and computational resources increase
Solution Approach 1:
The patent applies partial action by selectively monitoring only critical process execution points, stack structure changes, and certificate validations rather than analyzing all browser activities. This targeted approach maintains high detection capability while reducing unnecessary processing time and computational overhead.
Data Source
AI summary
The invention relates to an apparatus for detecting malicious sites, comprising: a monitoring unit for monitoring all processes being executed in a computing apparatus; a hook code insertion unit for inserting a hook code in a process executed in a browser when the execution of the browser is detected by the monitoring unit; a danger level determining unit that, upon the detection of a website movement, uses the hook code to inspect a stack structure of a process implemented according to the website movement and determine whether or not to perform the stack structure inspection, and determines whether or not the website to which the movement has been made is a malicious site; and a database for storing a list of sites determined to be malicious.