Disarming JavaScript in PDF and HWP Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods, such as signature-based inspection, fail to effectively detect malicious non-portable executable (non-PE) files, particularly those using JavaScript or macro scripts, as they can evade detection through encoding or inclusion within documents like PDFs and HWP files, making it difficult to determine if a file is malicious.
Innovation Solution
A method and apparatus that disarms JavaScript in non-PE files by identifying and modifying specific entries within the file's dictionary type, such as the 'JS' entry in PDFs and streams like 'DefaultJScript' and 'JScriptVersion' in HWP files, by comparing and substituting their values with empty strings, utilizing a server with a CDR engine to maintain the document structure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based inspection method is used to detect malicious non-PE files, then detection process is simple, but detection effectiveness is low because malware can evade through encoding or inclusion within scripts
Solution Approach 1:
The patent extracts JavaScript content from PDF documents by identifying and isolating JS entries within the document structure. This extraction enables the JavaScript to be inspected separately using specialized methods, improving detection effectiveness while maintaining manageable complexity through targeted processing
Solution Approach 2:
The patent introduces an intermediary process that bridges PDF inspection and JavaScript inspection. The system first identifies PDF documents, extracts JavaScript entries from them, then inspects the extracted JavaScript using appropriate inspection methods. This intermediary extraction and inspection mechanism resolves the contradiction by enabling effective malware detection without requiring complete restructuring of the inspection system
2Object-affected harmful factors
If JavaScript is removed from non-PE files to neutralize malware, then security is improved, but document functionality may be affected
Solution Approach 1:
The patent converts potentially harmful JavaScript content into a neutral state by extracting and inspecting it separately. The JavaScript is not completely removed but isolated and analyzed, allowing the system to neutralize malicious content while preserving legitimate JavaScript functionality that passes inspection. This approach transforms the harmful element into an inspectable object that can be safely handled
Solution Approach 2:
The patent applies different processing treatments to different JavaScript entries based on inspection results. Legitimate JavaScript that passes security inspection maintains its functionality, while malicious JavaScript is neutralized. This localized quality approach ensures that only harmful content is affected, preserving document functionality for safe content
3Measurement precision
If JavaScript entries are extracted and inspected from PDF documents, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent segments the inspection process into distinct phases: PDF document identification, JavaScript entry extraction, and JavaScript inspection. This segmentation allows each phase to be optimized independently and enables parallel processing where applicable, improving detection accuracy through thorough inspection while managing processing time through efficient phase organization
Data Source
AI summary
This specification relates to a method of disarming, by a server, a non-portable executable (non-PE) file. The method may include determining a document format of the non-PE file, searching for a dictionary type of the non-PE file on the basis of basic elements of the non-PE file by circulating throughout the non-PE file, based on the document format being a PDF, inspecting whether a JS entry is included in the dictionary type, and substituting a value of the JS entry with an empty string by comparing the value of the JS entry with the empty string.