Exploit-Kit Landing Page Detection via Script Behavior Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security products are ineffective in detecting exploit-kit landing pages, especially when exploit kits use zero-day exploits or obfuscation techniques, as they rely on static signatures that can be easily bypassed.
Innovation Solution
A computer-implemented method and system that monitors client-side script behaviors to detect attempts to access device attributes, determining if a web page is likely an exploit-kit landing page and performing security actions, such as redirecting users to safe pages, to prevent compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static signatures are used to detect exploit code, then detection simplicity is maintained, but detection effectiveness deteriorates due to easy bypassing with code modifications and obfuscation
Solution Approach 1:
The patent replaces static signature-based detection (mechanical pattern matching) with behavior-based detection that monitors runtime script actions. Instead of checking for fixed code patterns that can be easily modified, the system observes what the script actually does - accessing device attributes, making network requests, attempting exploits - providing reliable detection that cannot be bypassed by code obfuscation.
Solution Approach 2:
The patent changes the detection parameter from static code characteristics to dynamic behavior parameters. By monitoring script behaviors such as attribute access patterns, network communication timing, and exploitation attempts, the system adapts to detect various exploit kits regardless of their specific code implementation, making detection robust against modifications.
2Ease of manufacture
If static signatures are used for detection, then implementation simplicity is maintained, but adaptability to zero-day exploits deteriorates due to unavailability of signatures
Solution Approach 1:
The system replaces signature-based detection with behavior-based detection that does not require pre-existing knowledge of specific exploit code. By monitoring generic script behaviors that are common to exploit kits (accessing device attributes, making suspicious network requests), the system can detect zero-day exploits without needing specific signatures, while maintaining implementation simplicity through standardized monitoring procedures.
Solution Approach 2:
The patent creates a universal detection mechanism that monitors generic script behaviors rather than specific exploit code. This multi-functional approach allows the same detection system to identify various types of exploit kits including zero-day exploits, as it looks for common behavioral patterns rather than exploit-specific signatures.
3Reliability
If behavior monitoring is implemented to detect exploit-kit landing pages, then detection effectiveness improves, but system complexity increases
Solution Approach 1:
The patent extracts and monitors only the critical behavior parameters necessary for detection - specifically script attempts to access device attributes and suspicious network requests. By focusing on these key behaviors rather than monitoring all script activities, the system achieves effective detection while keeping complexity manageable through selective observation of high-risk actions.
Solution Approach 2:
The system introduces an intermediary monitoring layer that sits between the exploit-kit script and the device attributes. This mediator captures script behavior attempts to access attributes without allowing the script to actually compromise the device, enabling detection while maintaining system security and managing complexity through controlled observation.
4Reliability
If security actions are taken to prevent exploit-kit compromise, then device protection improves, but user convenience deteriorates due to potential false positives
Solution Approach 1:
The system implements feedback mechanisms that monitor script behaviors and provide information about detected threats. By analyzing behavior patterns and providing feedback on what constitutes suspicious activity, the system can make more accurate determination of actual threats versus false positives, balancing device protection with user convenience through informed security decisions.
Data Source
AI summary
The disclosed computer-implemented method for detecting exploit-kit landing pages may include detecting an attempt to access a web page via a computing device. The web page may be an unknown landing page of an exploit kit that includes a script that may be used by the exploit kit to access attributes of the computing device that may be used by the exploit kit to select suitable exploit code for compromising the computing device. The disclosed computer-implemented method may further include (1) monitoring one or more behaviors of the script, (2) detecting an attempt by the script to access an attribute of the computing device, (3) determining, based on the attempt to access the attribute, that the web page is likely a landing page of the exploit kit, and (4) performing a security action in response to the determination. Various other methods, systems, and computer-readable media are also disclosed.