Malicious Script Detection via Static and Dynamic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious web pages fail to recognize hidden dangerous HTML tags in obfuscated scripts, especially when new obfuscation techniques are used, leading to ineffective signature-based detection and potential browser performance issues.
Innovation Solution
A system and method that decomposes web pages into scripts, performs static and dynamic analysis, and compares results to determine malicious scripts, using a script execution function within a web browser to handle variant obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used to identify malicious scripts, then detection capability is maintained for known threats, but detection effectiveness fails against new obfuscation techniques and variant attacks
Solution Approach 1:
The patent implements dynamic analysis by actually executing the script in a controlled environment to observe its runtime behavior. This allows the detection system to adapt to new obfuscation techniques because it analyzes what the script actually does rather than relying on static signatures that can be easily evaded through obfuscation or new attack variants.
Solution Approach 2:
The patent introduces a script execution environment as an intermediary between the detection system and the malicious script. This intermediary executes the script and captures its behavior, allowing detection without directly confronting the obfuscated code, thereby maintaining effectiveness against new obfuscation techniques.
2Measurement precision
If hooking function execution is used to decode and analyze obfuscated scripts, then signature extraction is achieved, but web browser performance deteriorates and browser may malfunction
Solution Approach 1:
The patent segments the analysis process into distinct modules: script decomposition, static analysis, dynamic execution, and result comparison. This segmentation allows the system to perform comprehensive analysis without requiring hooking into the browser's core execution functions, thereby maintaining browser performance while achieving accurate detection.
Solution Approach 2:
The patent uses a separate script execution environment as an intermediary to analyze script behavior without hooking into the browser's native function execution. This approach extracts behavioral signatures accurately while avoiding the performance degradation and potential malfunctions associated with hooking techniques.
3Productivity
If conventional pattern matching is used to detect malicious scripts, then detection is simple and fast, but the pattern becomes unusable when new obfuscation techniques are applied
Solution Approach 1:
The patent transitions from static pattern matching to dynamic behavioral analysis by executing scripts and observing their runtime actions. This dynamic approach maintains detection speed through automated execution while achieving adaptability to new obfuscation techniques because it captures the essential behavior that remains consistent regardless of obfuscation.
Solution Approach 2:
The patent changes the detection parameter from static code patterns to dynamic execution behavior. By monitoring what the script does rather than how it is written, the system maintains fast automated detection while becoming insensitive to obfuscation transformations that alter the code's appearance but not its function.
Data Source
AI summary
Provided are a system and method for detecting a malicious script. The system includes a script decomposition module for decomposing a web page into scripts, a static analysis module for statically analyzing the decomposed scripts in the form of a document file, a dynamic analysis module for dynamically executing and analyzing the decomposed scripts, and a comparison module for comparing an analysis result of the static analysis module and an analysis result of the dynamic analysis module to determine whether the decomposed scripts are malicious scripts. The system and method can recognize a hidden dangerous hypertext markup language (HTML) tag irrespective of an obfuscation technique for hiding a malicious script in a web page and thus can cope with an unknown obfuscation technique.