JavaScript Classifier With Deobfuscation for Real-Time Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in detecting malicious JavaScript code in real-time with high accuracy and low false positives, leading to potential delays and increased infection risk.
Innovation Solution
A real-time JavaScript classifier using a semi-static classifier that deobfuscates JavaScript content, employs classification features and models, and utilizes a Deep Neural Net trained on known benign and malicious content sources to identify malicious objects with high detection rates and low false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If real-time detection of malicious JavaScript code is implemented, then detection speed is improved, but detection accuracy may deteriorate
Solution Approach 1:
The detection system is divided into multiple independent modules: a JavaScript interpreter that executes code in a sandboxed environment, a static analysis component that examines code patterns, and a dynamic monitoring system that tracks execution behavior. Each module operates independently and contributes partial results, allowing the system to maintain high detection speed through parallel processing while achieving high accuracy through the aggregation of multiple analysis perspectives.
Solution Approach 2:
A sandboxed JavaScript virtual machine is introduced as an intermediary between the malicious code and the host system. This intermediary environment allows the code to execute safely while the system monitors its behavior, capturing execution traces, system calls, and resource consumption patterns. The intermediary enables real-time detection without requiring direct analysis of the original code, thus maintaining both speed and accuracy.
2Measurement precision
If comprehensive analysis of JavaScript code is performed, then detection accuracy is improved, but scanning speed deteriorates
Solution Approach 1:
The system performs preliminary static analysis on JavaScript code before full execution, identifying suspicious patterns, obfuscated code sections, and high-risk functions. Based on this preliminary assessment, the system dynamically adjusts the depth of analysis: low-risk code receives minimal processing while high-risk code undergoes comprehensive dynamic analysis. This selective approach maintains high detection accuracy for malicious code while preserving scanning speed for benign code.
Solution Approach 2:
The system implements a multi-layered detection approach where not all code receives the same level of analysis. Critical sections identified through static analysis trigger more intensive dynamic monitoring, while non-critical sections receive lighter processing. This partial action strategy ensures that comprehensive analysis is applied only where necessary, maintaining overall scanning speed while achieving high detection accuracy for malicious portions.
3Reliability
If JavaScript code is executed in a sandboxed environment for analysis, then detection capability is improved, but system resource consumption increases
Solution Approach 1:
The sandboxed execution environment operates periodically rather than continuously, activating only when JavaScript code requires analysis. Between analysis cycles, the sandbox remains dormant, consuming minimal resources. The system uses timeouts and activity detectors to manage sandbox lifecycle, terminating execution after a predetermined period or when analysis objectives are met, thus reducing overall resource consumption while maintaining detection capability when needed.
Solution Approach 2:
The sandboxed environment is designed to be transient, creating isolated execution contexts on-demand and discarding them after use. Rather than maintaining a permanent sandbox, the system spawns temporary sandboxes for each analysis task and recovers resources by terminating them afterward. This approach enables high detection capability during active analysis while minimizing resource consumption during idle periods, as sandboxes are created and destroyed as needed.
Data Source
AI summary
Aspects of the present disclosure are operable to protect against malicious objects, such as JavaScript code, which may be encountered, downloaded, or otherwise accessed from a content source by a computing system. In an example, antivirus software implementing aspects disclosed herein may be capable of detecting malicious objects in real-time. Aspects of the present disclosure aim to reduce the amount of time used to detect malicious code while maintaining detection accuracy, as detection delays and/or a high false positive rate may result in a negative user experience. Among other benefits, the systems and methods disclosed herein are operable to identify malicious objects encountered by a computing system while maintaining a high detection rate, a low false positive rate, and a high scanning speed.