Malicious Code Detection via De-armouring and Proxy Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect malicious code injected into web pages, as it uses encryption to evade detection and exploits system privileges, and is difficult to detect due to web browser memory management, making it hard for traditional anti-virus and intrusion detection systems to identify and prevent infection.
Innovation Solution
A two-stage process involving filtering web-page code to detect suspicious strings based on length, polymorphism, and scripting tags, followed by de-armouring the code in a sandbox or system memory with garbage collection disabled, allowing existing anti-virus or intrusion detection systems to inspect and remove the malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anti-virus scanning is used on web pages, then detection speed is maintained, but malicious code encrypted in web pages cannot be detected
Solution Approach 1:
The patent applies preliminary action by decrypting and de-armouring the malicious code before it executes in the web browser. The system intercepts the web page, identifies encrypted malicious code, decrypts it, and passes it to HIDS for inspection before the code can infect the system. This prevents the malware from establishing itself while maintaining compatibility with existing security systems.
Solution Approach 2:
The patent introduces an intermediary component that acts as a bridge between the web browser and existing HIDS. This intermediary decrypts and de-armours malicious code, then passes it to the HIDS in a format that the existing system can analyze. This allows traditional anti-virus systems to detect encrypted malware without requiring complete system redesign.
2Object-affected harmful factors
If port blocking is implemented to prevent malware propagation, then malware transmission is blocked, but web browsing functionality is removed
Solution Approach 1:
The patent extracts the malicious code from the legitimate web page content. Instead of blocking the entire HTTP port or disabling web browsing, the system identifies and separates the encrypted malicious code from the legitimate web page, decrypts it for inspection, and allows the legitimate content to proceed normally. This enables selective removal of harmful elements while preserving useful functionality.
3Measurement precision
If HIDS scans memory after web browser execution, then post-execution detection is performed, but malicious code is already executed and garbage collection removes evidence
Solution Approach 1:
The patent performs detection before the malicious code executes and before garbage collection removes evidence. By intercepting and decrypting the malicious code in the web page before browser execution, the system passes the decrypted code to HIDS for inspection at the optimal time when the malware is present but尚未 executed. This prevents both execution and evidence destruction.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Embodiments of the invention are directed towards detecting and identifying malicious code injected into other legitimate web pages. The detection is divided into two processes. The first process is to detect a malicious code string within received web page code using a set of one or more criteria. The criteria include length of the string, as well as whether the string changes between received instances, and the status of the string within the web page code, particularly whether it is encapsulated between scripting tags, or otherwise indicated as being executable. The second process is based on using a proxy that will help in extracting and scanning the decrypted code against any malicious content. In particular, the second phase acts to remove the armour and evasion features that may be built into the malicious code, so that the code may then be inspected by the existing anti-virus or other host intrusion detection system (HIDS) present on the target system. Inspection may take place by dumping the memory contents to a file and then passing the file for inspection to the existing anti-virus or other HIDS.