Runtime JavaScript Execution Trace Analysis for Dynamic Exploit Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current security solutions are inadequate in detecting and preventing security vulnerabilities in web applications, particularly with HTML5 and JavaScript, due to their dynamic nature and lack of runtime monitoring capabilities, leading to potential exploitation by malicious scripts.

Innovation Solution

An enhanced security system that captures and analyzes JavaScript execution traces in real-time, using a recorder and security engine to detect exploits without relying on static analysis or browser-specific plugins, and provides an API for integration with existing security products.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If static analysis of JavaScript is used to detect security vulnerabilities, then known exploits can be detected, but dynamic exploits and encrypted content cannot be reliably detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidcapability to detect dynamic and encrypted exploits

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent transitions from static analysis to dynamic analysis by implementing a runtime monitoring system that hooks into the JavaScript engine. This allows the security system to observe JavaScript execution in real-time, capturing actual runtime behavior including dynamic content loading and encrypted operations, thereby resolving the contradiction between detection accuracy and adaptability to dynamic exploits

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent introduces an intermediary security layer that sits between the JavaScript engine and the application. This intermediary hooks into the JavaScript runtime environment to capture execution traces without interfering with normal operation, enabling detection of both static and dynamic exploits while maintaining system performance

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If browser-specific plugins are used for security monitoring, then HTML5 functionality can be monitored, but the solution becomes browser-dependent and complex

Engineering Contradiction:

ImproveHTML5 monitoring capabilityVSAvoidbrowser plugin dependency

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent creates a universal security monitoring system that hooks into the JavaScript engine directly rather than using browser-specific plugins. This approach provides HTML5 monitoring capability across all browsers that support the target JavaScript engine version, eliminating browser dependency and reducing overall system complexity while maintaining reliable HTML5 functionality monitoring

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If all scripts are blocked in the web browser to prevent malware execution, then security is improved, but user online experience is degraded

Engineering Contradiction:

Improvesecurity protectionVSAvoiduser online experience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements a feedback-based security system that continuously monitors JavaScript execution and analyzes behavior patterns in real-time. The system provides feedback by allowing legitimate scripts to execute while blocking only malicious operations, thereby maintaining both security protection and acceptable user online experience through intelligent differentiation rather than blanket blocking

Inventive Principle:

Principle #23Feedback

4Measurement precision

If runtime monitoring of JavaScript execution is implemented, then dynamic exploits can be detected, but system performance overhead increases

Engineering Contradiction:

Improvedynamic exploit detectionVSAvoidcomputational overhead

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies partial monitoring by selectively hooking into specific JavaScript execution points and APIs rather than monitoring all operations. This approach captures sufficient information to detect dynamic exploits while minimizing the performance overhead associated with comprehensive runtime monitoring, achieving a balance between detection capability and system performance

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11194914B2Method and apparatus to detect security vulnerabilities in a web application

Publication Date: 2021.12.07 MCAFEE LLC

AI summary

An improved anti-malware protection system protects computers against exploits in a scripting language that may be run in a browser. The system comprises a recorder that records scripting language execution events, a trace generator that transforms the recorded scripting language execution events into an execution trace, and a security engine that scans the execution trace and advises a security software about exploits found in the execution trace. By hooking the recorder into a runtime application programming interface for the scripting language, the improved protection system can detect exploits dynamically without the need for a browser-dependent plugin. An optional plugin can be included to perform file-based analysis of the script in addition to the runtime analysis of the script. The system can provide an application programming interface that can be used by multiple security software programs from multiple vendors to create an enhanced security software product.