Malicious Code Detection via Character Sequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious code in script attacks are limited to known NOP sleds, making them ineffective against new attacks and prone to false positives, and do not adequately protect web browsers from buffer overflows and similar exploits.
Innovation Solution
A system and method that detect and classify operation code sets as malicious or non-malicious by analyzing predetermined sequences of characters, including NOP sleds and shellcode, using a detection module that identifies non-printable and printable characters, and filters false positives based on reputation and potential damage assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current detection methods use known NOP sleds for detection, then detection simplicity is maintained, but detection precision deteriorates making them ineffective against new attacks
Solution Approach 1:
The patent changes the detection parameter from specific known NOP sled patterns to analysis of predetermined character sequences within operation code sets. This allows detection of both known and unknown malicious code by examining the structural characteristics of the code rather than relying on pre-defined signatures, thereby improving detection precision while maintaining manageable complexity through automated analysis.
Solution Approach 2:
The detection system transitions from static signature matching to dynamic analysis of operation code sets. The system adapts to new attacks by analyzing the actual character sequences and structures present in the code being executed, allowing it to detect previously unknown malicious patterns without requiring updates to a signature database.
2Reliability
If detection systems block all suspicious code, then security protection is improved, but false positives increase reducing system reliability
Solution Approach 1:
The patent applies different detection criteria to different portions of the code. Instead of treating all code uniformly, the system analyzes specific predetermined sequences of characters within operation code sets and applies context-aware evaluation. This localized analysis allows the system to distinguish between legitimate and malicious code more accurately, reducing false positives while maintaining security.
3Adaptability or versatility
If traditional detection methods are used, then ease of operation is maintained, but adaptability to new attacks deteriorates
Solution Approach 1:
The detection system performs self-updating through automated analysis of operation code sets. By examining the actual character sequences and structures in the code being executed, the system automatically adapts to new attack patterns without requiring manual updates to detection signatures. This self-service capability maintains ease of operation while dramatically improving adaptability to emerging threats.
Data Source
AI summary
A computer-implemented method to detect malicious code in a script attack, is described. An activity associated with calling a function is detected. An operation code set associated with the activity to call the function is identified. A predetermined sequence of characters included in the operation code set is identified. The identified predetermined sequence of characters is analyzed. The operation code set is classified as malicious or non-malicious based on the analysis of the predetermined sequence of characters.