Malicious JavaScript Detection via Browser Emulator Behavioral Scoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods are ineffective in detecting and blocking malicious JavaScript due to its obfuscation, leading to high false negatives and positives, and fail to identify websites that attempt to download malicious scripts, as they cannot distinguish between legitimate and malicious obfuscation.

Innovation Solution

A system that uses an enhanced browser emulator with instrumented functions to analyze and score website behaviors, flagging suspicious activities such as cookie theft, dynamic target generation, and shellcode insertion, and categorizing vulnerabilities to quantify the likelihood of hostile intent, employing dynamic analysis and behavioral tracing within a virtual machine environment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If static analysis such as signature matching is used to detect malicious JavaScript, then detection speed is improved, but detection accuracy deteriorates due to obfuscation

Engineering Contradiction:

Improvedetection speedVSAvoiddetection accuracy

Core Design Contradiction:

SpeedVSMeasurement precision

Solution Approach 1:

The patent replaces static signature matching (mechanical pattern recognition) with dynamic behavioral analysis using a browser emulator. The system executes JavaScript in a controlled virtual environment and monitors actual runtime behaviors, substituting the mechanical search-for-signatures approach with a dynamic observation-of-execution approach that can distinguish obfuscated malicious code from legitimate code based on its actual actions rather than its appearance.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the detection parameter from static code characteristics (signatures, patterns) to dynamic behavioral parameters (API calls, navigation actions, data modifications). By measuring what the code actually does during execution rather than what it looks like in source form, the system overcomes obfuscation while maintaining detection speed through automated behavioral scoring.

Inventive Principle:

Principle #35Parameter changes

2Reliability

If obfuscation detection is used to identify malicious JavaScript, then potential threats are flagged, but false positives and false negatives increase

Engineering Contradiction:

Improvethreat identificationVSAvoidfalse positive rate

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent performs preliminary execution of JavaScript in a controlled browser emulator environment before making security decisions. By pre-executing the code in a safe virtualized setting and observing its behavioral fingerprint, the system establishes a baseline of actual actions taken, which serves as more reliable evidence of malicious intent than mere presence of obfuscation techniques, thereby reducing false positives and negatives.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback through behavioral scoring, where observed actions during emulator execution are weighted and summed to produce an overall maliciousness score. This feedback mechanism allows the system to adjust its detection threshold and interpretation based on the cumulative evidence from multiple behavioral indicators, improving reliability while reducing error rates compared to binary obfuscation detection.

Inventive Principle:

Principle #23Feedback

3Measurement precision

If behavioral analysis in a browser emulator is used to detect malicious JavaScript, then detection accuracy is improved, but system complexity increases

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent introduces a browser emulator as an intermediary layer between the suspicious JavaScript and the actual target system. This virtualized browser environment acts as a safe mediator that executes the potentially malicious code and captures its behavioral output, allowing accurate detection without requiring complex analysis of the JavaScript source itself or risking the target system. The intermediary handles the complexity of JavaScript execution internally while presenting simplified behavioral observations to the detection system.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Measurement precision

If dynamic analysis with instrumented functions is used to trace JavaScript behavior, then vulnerability categorization is improved, but processing time increases

Engineering Contradiction:

Improvevulnerability categorizationVSAvoidprocessing time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies partial monitoring by focusing instrumented function calls only on specific high-risk JavaScript APIs and behaviors most likely to indicate security vulnerabilities. Rather than tracing every single function call and operation, the system selectively instruments only the critical paths and dangerous function categories, achieving sufficient vulnerability categorization accuracy while limiting the processing time overhead to essential observations only.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8789178B2Method for detecting malicious javascript

Publication Date: 2014.07.22 BARRACUDA NETWORKS INC

AI summary

An apparatus and system for scoring and grading websites and method of operation. An apparatus receives one or more Uniform Resource Identifiers (URI), requests and receives a resource such as a webpage, and observes the behaviors of an enhanced browser emulator as controlled by javascript provided by the webpage. The enhanced browser emulator tracks behaviors which when aggregated imply malicious intent.