Browser Log Matching for Analysis Avoidance Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to identify and analyze 'analysis avoidance code' that exploits browser-specific functions or implementation differences between real browsers and pseudo-browsers, making it difficult to detect malicious websites using Drive-by Download attacks.
Innovation Solution
An analysis apparatus and method that utilize the differences between real browser and pseudo-browser environments to identify 'analysis avoidance code' by creating transfer graphs from access logs and matching them to detect malicious URLs, allowing for the identification of JavaScript codes that avoid analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a pseudo-browser is used to simulate a real browser environment for analyzing malicious websites, then the ability to execute and analyze JavaScript codes is improved, but the ability to detect analysis avoidance codes that exploit browser-specific functions deteriorates
Solution Approach 1:
Instead of trying to make the pseudo-browser perfectly replicate the real browser, the invention inverts the approach by using the real browser to analyze the malicious website and comparing its behavior with the pseudo-browser. The analysis avoidance code is detected by identifying discrepancies in execution results between the two browsers, turning the limitation of the pseudo-browser into a detectable signal.
Solution Approach 2:
The invention introduces an intermediary analysis mechanism that captures and compares the execution traces of both the real browser and pseudo-browser. This intermediary layer monitors the control flow graphs and execution paths, identifying when the analysis avoidance code causes divergent behavior between the two browser environments.
2Measurement precision
If browser-specific functions are used for browser fingerprinting to improve attack precision, then the success rate of Drive-by Download attacks is improved, but the detectability of the attack code deteriorates
Solution Approach 1:
The invention detects browser-specific function usage by inverting the detection approach: instead of trying to identify the browser type directly, it executes the malicious code in a controlled environment and observes whether browser-specific behaviors are triggered. The analysis avoidance code is identified by the异常 patterns it creates when exploiting these browser-specific functions.
Solution Approach 2:
The invention changes the parameter of browser environment from a static simulation (pseudo-browser) to a dynamic comparison between real and simulated environments. By varying the browser configuration parameters and observing execution differences, the system can detect when analysis avoidance codes are exploiting specific browser implementations.
3Ease of operation
If existing analysis methods are used to detect malicious websites, then the detection process is simplified, but the ability to identify analysis avoidance codes deteriorates
Solution Approach 1:
The invention segments the analysis process into distinct phases: (1) executing the malicious code in both real and pseudo-browsers, (2) capturing execution traces separately, (3) comparing the traces to identify discrepancies, and (4) flagging potential analysis avoidance codes. This segmentation maintains operational simplicity while enabling sophisticated detection through systematic comparison.
Data Source
Figure 1
Figure 2(a)~2(b)
Figure 3
AI summary
An analysis apparatus (10) has a transfer path matching unit (151) that is provided with a real browser log La and a browser emulator log Lb as input and identifies, as a specific transfer path, a transfer path that is not transferred to a malicious URL on a pseudo-browser where the transfer path is transferred to the malicious URL on a real browser, based on the malicious URL information in a malicious URL database (14), and an analysis avoidance code identification unit (152) that identifies an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on a website, based on the specific transfer path.