Dynamic Script Analysis for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing scripts, such as those written in JavaScript, are inadequate in detecting malicious content that can cause damage to computers, as they rely on static analysis and fail to discover dynamic or executed code changes.
Innovation Solution
A method and system that processes scripts by executing and copying text blocks of code into an output file, allowing for dynamic analysis of generated code blocks that may not be directly inferred from the original script, enabling detection of malicious content like executable file downloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis methods are used to analyze scripts, then the analysis process is simple and fast, but malicious content that can cause damage to computers cannot be discovered
Solution Approach 1:
The patent applies dynamic analysis by actually executing the script code in a controlled environment to observe its runtime behavior. Instead of statically examining code, the system runs the script and captures output data, allowing detection of malicious content that only manifests during execution. This resolves the contradiction by sacrificing some simplicity for significantly improved detection accuracy.
Solution Approach 2:
The patent introduces an intermediary execution environment that acts as a mediator between the script and the analysis system. The script is executed in this controlled intermediate environment, and its output is captured and analyzed. This intermediary layer enables dynamic analysis without directly exposing the main system to potential malicious effects, resolving the contradiction between detection accuracy and system safety.
2Measurement precision
If dynamic execution of script blocks is performed to generate new code, then new malicious content can be detected, but the analysis time and processing resources increase
Solution Approach 1:
The patent segments the script into multiple discrete blocks that are executed sequentially. Each block is processed independently, and output data is captured at each stage. This segmentation allows the analysis to be performed in manageable increments rather than requiring complete script execution, reducing overall analysis time while maintaining detection accuracy.
Solution Approach 2:
The patent performs preliminary actions by pre-processing and preparing the script blocks before full execution. The script is divided into blocks in advance, and the execution environment is prepared beforehand. This preliminary preparation reduces the time required during actual analysis by having the structure ready for efficient processing.
3Measurement precision
If complete script execution is performed to capture all generated code, then all malicious content is revealed, but the risk of executing malicious code increases
Solution Approach 1:
The patent uses an intermediary controlled execution environment that isolates the script from the main system. The script executes in this sandboxed environment where any malicious actions are contained and captured as output data rather than affecting the host system. This resolves the contradiction by enabling complete execution for thorough detection while preventing harmful effects through isolation.
Solution Approach 2:
The patent creates a copy of the script execution environment to perform analysis. Instead of running the script directly on the main system, a replicated execution environment is used where output data is captured. This copying approach allows complete execution for thorough detection while protecting the original system from potential harm.
Data Source
AI summary
A method and associated system. A first computer executes at least two text blocks of code derived from a script of a web page in response to a request for the web page from a client computer. The text blocks are executed sequentially in a sequential order. The script is a first text block of the at least two text blocks. The execution of one text block of the at least two text blocks by the first computer generates a new text block of code.