Malicious Code Detector Hook for Obfuscated Script Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems (IDS) fail to detect obfuscated JavaScript code embedded in HTML or associated files, allowing malicious code to execute and harm client computers, as they scan the code before it is executed and converted into its operational form, missing attacks that require multiple iterations of processing and execution.
Innovation Solution
A system that includes a web browser with a malicious-code detector that scans program code before and after execution, using a 'hook' or jump instruction to divert processing to the detector for signature, pattern, and heuristic analysis, preventing execution of malicious code at each stage, including revised code generated during multiple iterations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If known IDS scan the obfuscated script code from HTML or associated files before execution, then the scanning process is simple and fast, but the IDS cannot detect the malicious code because it is still obfuscated at that stage
Solution Approach 1:
The system performs preliminary scanning of the obfuscated code in the HTML file before execution, then sets up a hook to scan the revised code again after the script execution engine processes it. This two-stage preliminary action ensures detection at both the obfuscated and deobfuscated stages, resolving the contradiction between scanning speed and detection accuracy.
Solution Approach 2:
The system implements a feedback mechanism where the script execution engine's output (revised code) is fed back to the IDS for scanning. The hook intercepts the execution flow and redirects the revised code back to the scanning module, creating a closed-loop feedback system that continuously monitors code transformations and detects malicious patterns that emerge during execution.
2Ease of operation
If the IDS allows the obfuscated code to pass to the web browser for execution, then the browser can process the code, but the malicious code may be converted into operational form and execute harmful actions
Solution Approach 1:
The hook acts as an intermediary between the script execution engine and the code execution process. It intercepts the revised code generated by the execution engine and redirects it to the IDS for scanning before allowing execution to proceed. This intermediary mechanism enables the browser to maintain full functionality while preventing malicious code from executing harmful actions.
3Reliability
If the IDS scans code at multiple stages including after execution, then detection accuracy improves, but the system complexity increases due to hooks and multiple scanning points
Solution Approach 1:
The system merges the IDS scanning functionality with the browser's existing script execution architecture by implementing a hook mechanism that integrates seamlessly into the execution flow. Rather than adding a completely separate scanning system, the IDS is combined with the script execution engine's output processing, reducing overall system complexity while maintaining multi-stage detection capability.
Data Source
AI summary
Detecting obfuscated attacks on a computer. A first program function is invoked to render static components of a web page and identify program code within the web page or associated file. In response, before executing the identified program code, a malicious-code detector is invoked to scan the identified program code for malicious code. If the malicious-code detector identifies malicious code in the identified program code, the identified program code is not executed. If no malicious code is detected, a second program function generates revised program code from execution of the identified, program code. In response, before executing the revised program code, the malicious-code detector is invoked to scan the revised program code for malicious code. If the malicious-code detector identifies malicious code in the revised program code, the revised program code is not executed.