Hooking Engine for Obfuscated Script Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are unable to effectively detect and prevent execution of security-sensitive operations, particularly in obfuscated JavaScript code, as they are bypassed by string concatenation techniques, and fail to inspect web scripts and other code in a timely and accurate manner, leading to undetected malicious attacks.
Innovation Solution
Implementing generic hooking of computer applications by hooking into the browser's script interpreter to read clear-text buffers, using a hooking engine that matches configuration parameters with signature lists, allowing for context-based detection and prevention of malicious operations, thereby enhancing detection rates and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If pattern-matching security applications are used to detect malicious code, then detection capability is provided for known patterns, but obfuscated code using string concatenation can bypass detection
Solution Approach 1:
The hooking mechanism intercepts and inspects script code at the interpreter level before execution occurs. This preliminary inspection allows the security system to analyze the actual runtime values of variables and strings, detecting malicious patterns even when they are obfuscated through concatenation operations that only reveal their true form during execution.
Solution Approach 2:
The patent introduces a hooking engine as an intermediary layer between the script interpreter and the executed code. This intermediary captures function calls and inspects parameters at the clear-text level, acting as a mediator that can detect malicious intent without being fooled by obfuscation techniques used in the original script.
2Reliability
If code inspection is performed early to prevent malicious operations, then security is improved, but detection accuracy is reduced due to lack of complete runtime state
Solution Approach 1:
The hooking mechanism performs preliminary inspection of script code at the interpreter level, capturing function calls and parameters before they are executed. This timing allows the system to obtain complete runtime state information including the actual evaluated values of variables and strings, achieving both early security intervention and high detection accuracy.
Solution Approach 2:
The system uses feedback from the script interpreter's runtime state to improve detection accuracy. By monitoring how variables are actually used during script execution and obtaining clear-text representations of runtime values, the system can make more accurate security decisions with complete contextual information.
3Reliability
If network-based IDS/IPS is used to scan for malicious patterns, then network security is provided, but detection rate is low and false positives are high due to scanning entire HTML pages
Solution Approach 1:
The patent segments the inspection process by focusing only on specific function calls and their parameters within the script code, rather than scanning entire HTML pages. The hooking mechanism identifies and inspects only the relevant portions of code that are actually executed, significantly reducing false positives while improving detection rate by concentrating resources on high-risk areas.
Solution Approach 2:
The system applies different inspection strategies to different parts of the code based on their security relevance. By hooking specific function calls and inspecting their parameters locally at the point of execution, the system provides targeted security analysis that achieves high detection accuracy without the overhead and false positives of comprehensive page-wide scanning.
Data Source
AI summary
The present invention discloses methods and media for hooking applications to monitor and prevent execution of security-sensitive operations, the method including the steps of: reading at least one configuration parameter list from a configuration module; hooking, by a hooking engine, a hooking point in an application, wherein the hooking point is defined in the configuration module; calling, by the application, the hooking point during operation of the application; matching at least one hooking parameter in the hooking point to at least one configuration parameter in at least one configuration parameter list; and upon detecting a match between the hooking parameter and at least one configuration parameter, performing at least one configuration-defined action. Preferably, the method further includes the step of: updating a state of the hooking engine. Preferably, the hooking engine is operative to prevent malicious operations by obfuscated code.