Malicious Code Detection via Structural Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious code in browsers are limited in their detection capabilities, as they rely on signature matching and require human intervention for unknown malicious code, and maintaining a database of signatures is time-intensive and error-prone, making them ineffective against new or variant malicious code.
Innovation Solution
A method that normalizes inserted malicious code by removing content-related data, selecting alphanumeric strings to represent code constructs, and comparing these normalized constructs against a corpus of known patterns to identify malicious scripts, allowing for detection of previously unseen code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to identify malicious code, then detection accuracy for known threats is improved, but the system becomes ineffective against new or variant malicious code and requires continuous manual updates
Solution Approach 1:
The patent transforms the detection approach by changing the parameters being analyzed from exact signature matching to structural feature extraction. Instead of comparing complete code sequences, the system extracts and compares normalized code constructs (control flow, data flow, operation sequences), allowing detection of malicious code based on structural patterns rather than exact content matches. This enables detection of variant and new threats while maintaining accuracy for known threats.
Solution Approach 2:
The patent creates normalized representations (copies) of code constructs that capture essential structural features while removing content-specific variations. By creating these abstracted copies of code patterns and comparing structural features rather than original code content, the system can identify malicious intent across different implementations and obfuscation techniques.
2Reliability
If a database of signatures is maintained to detect malicious code, then detection capability for known threats is improved, but the maintenance process becomes time-intensive and error-prone
Solution Approach 1:
The patent implements a self-updating detection system that automatically learns and adapts to new malicious code patterns without requiring manual intervention. The system extracts structural features from detected threats and automatically updates its detection models, enabling continuous improvement of detection capability while eliminating the time-consuming and error-prone manual signature database maintenance process.
3Measurement precision
If exact signature matching is performed on inserted code, then precise identification of known malicious patterns is achieved, but the system fails to detect obfuscated or dynamically changed malicious code
Solution Approach 1:
The patent extracts essential structural features from code while separating them from content-specific details that can be obfuscated. By taking out and analyzing only the core structural elements (control flow patterns, data flow relationships, operation sequences) and ignoring variable names, string literals, and other mutable content, the system achieves precise pattern identification that is resistant to obfuscation and dynamic changes.
Data Source
AI summary
A method, system, and computer program product for detecting malicious code insertion in data are provided in the illustrative embodiments. At an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content is detected. A content-related portion is removed from the script to form a remaining script structure, the content-related portion referring to the content in the mix. From the remaining script structure, a code construct is selected and replaced with an alphanumeric string to form a normalized construct. Whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts is determined. Responsive to the normalized construct matching the second normalized construct within the tolerance, a conclusion is drawn that the script is malicious.