Malicious Code Detection via Event Object Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious software code are ineffective due to obfuscation and the ability of attackers to spread scripts across multiple files, making it difficult to identify and match malicious code using simple expression or string matching.
Innovation Solution
A computer-implemented method that intercepts primary function calls in a software application, creates event objects with attributes related to these calls, and stores them in a data structure, allowing for the application of rules to determine whether malicious activity is present, thereby identifying and tracing malicious scripts or code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If simple expression or string matching is used to detect malicious code, then the detection method is simple and fast, but it becomes ineffective against obfuscated or distributed malicious code
Solution Approach 1:
The patent segments malicious code into functional units based on event objects (function calls, DOM manipulations, network requests). Instead of treating code as continuous text for string matching, it divides execution into discrete events that can be individually analyzed and pattern-matched, making detection robust against obfuscation while maintaining efficiency through structured processing
Solution Approach 2:
The patent introduces event objects as an intermediary layer between the raw code and the detection engine. These event objects capture essential execution characteristics without being tied to specific code representations, serving as a mediator that enables reliable pattern matching regardless of how the original code is obfuscated or distributed across files
2Object-affected harmful factors
If attackers obfuscate malicious code or spread it across multiple files, then the malicious code becomes harder to detect, but the complexity of analysis increases
Solution Approach 1:
The patent creates copies of malicious code behavior in the form of event objects that represent function calls, DOM manipulations, and network requests. These event object copies capture the essential malicious patterns without requiring analysis of the actual obfuscated code, simplifying detection while maintaining accuracy across distributed code segments
Solution Approach 2:
The patent merges event objects from multiple code files into a unified collection that represents the complete malicious behavior. By combining events from distributed code segments and analyzing them as a cohesive sequence, the system detects malicious patterns regardless of how the code is split across multiple files, reducing analysis complexity through unified processing
Data Source
AI summary
A system, method, and computer-readable medium for detecting malicious computer code are provided. Instructions, such as HTML or JavaScript instructions may be received from a server, parsed, and executed. During execution of the instructions, one or more functions of a software application, such as a web browser, may be hooked, and an event object may be created for each called function that is hooked, resulting in a collection of event objects. Rules may be matched with event objects of the collection of event objects to detect malicious code. Attributes from the matched event objects may then be used to locate original malicious script or code injected into a web page.