JavaScript Heap Monitoring for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for monitoring zero-day attacks rely on manual analyses or signature-based detection, which can miss attacks due to reliance on specific application versions and environments, and fail to detect malware before its execution.
Innovation Solution
The system hooks a call to a sandbox API engine to monitor script code in the heap before execution, using execution profiling to analyze JavaScript for malware, even if the target application is not the correct version, by injecting code into the script API process address space and utilizing an execution profiling mechanism to track execution branches and identify potential indicators of malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used to monitor zero-day attacks, then detection reliability is improved for known malware, but detection capability deteriorates for zero-day attacks due to reliance on specific application versions and environments
Solution Approach 1:
The system performs preliminary analysis of script code in the heap memory before execution occurs. By hooking into the script API engine and analyzing JavaScript code prior to its execution, the system can detect zero-day malware attacks before they are activated, eliminating the need to wait for execution handlers or rely on specific application versions.
2Measurement precision
If manual analysis or signature-based detection is used, then detection accuracy is improved for known patterns, but detection speed deteriorates due to waiting for execution and environmental matching
Solution Approach 1:
The system performs preliminary analysis of script code in the heap memory before execution occurs. By hooking into the script API engine and analyzing JavaScript code prior to its execution, the system can detect zero-day malware attacks before they are activated, eliminating the need to wait for execution handlers or rely on specific application versions.
Solution Approach 2:
The system extracts and analyzes only the script code portion from the heap memory, separating the analysis from the full execution environment. This allows the system to focus on detecting malicious patterns in the JavaScript code itself without being constrained by environmental factors or requiring complete execution of the malware.
3Reliability
If execution-based monitoring is used, then detection reliability is improved by observing actual malware behavior, but detection coverage deteriorates because execution handlers may not implement intended malware versions
Solution Approach 1:
The system performs preliminary analysis of script code in the heap memory before execution occurs. By hooking into the script API engine and analyzing JavaScript code prior to its execution, the system can detect zero-day malware attacks before they are activated, eliminating the need to wait for execution handlers or rely on specific application versions.
Solution Approach 2:
The system introduces an intermediary analysis layer that operates between the script code storage (heap memory) and the script execution engine. By analyzing the JavaScript code in the heap through hooked API calls before execution, the system creates an intermediate detection point that captures malware regardless of whether execution handlers are properly implemented.
Data Source
AI summary
Embodiments are directed to hooking a call for a malware monitoring logic into a JavaScript API engine interpreter. Upon JavaScript being placed into heap memory, the malware monitoring logic can initiate an evaluation or analysis of the heap spray to determine whether the JavaScript includes malware or other malicious agents prior to execution of the JavaScript shell code. Upon execution of the JavaScript within the sandbox, the malware monitoring logic can initiate monitoring of the JavaScript using malware analysis and/or execution profiling techniques. Inferences can be made of the presence of malware based on a start and end time of the JavaScript execution.