Network Script Emulation for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting malicious JavaScript are unreliable and slow, unable to provide timely protection against covert threats, especially in environments like medical devices, military systems, and IoT devices, where installation of protective software is restricted, and often require offline operation.
Innovation Solution
A network-level detection system that isolates and distills scripts into bytecode, executes them in a lightweight emulation setting, and analyzes the results to identify potentially malicious behavior, operating on network packets before they reach the end-user device, allowing for real-time or near real-time detection without significant delay.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If current diagnostic methods are used to detect malicious JavaScript, then detection can be performed, but the detection is slow and cannot meet the demand to analyze all potentially threatening websites in real-time
Solution Approach 1:
The patent replaces traditional mechanical analysis methods (static code analysis, heuristic scanning) with a virtual machine-based execution environment. The JavaScript code is executed in a controlled virtual machine that mimics a real browser environment, allowing dynamic behavior analysis. This substitution enables real-time detection while maintaining reliability by observing actual code execution rather than relying on slow pattern matching.
Solution Approach 2:
The patent introduces a virtual machine as an intermediary between the malicious JavaScript and the analysis system. The virtual machine acts as a sandboxed execution environment that mediates the code execution, capturing behavior without allowing actual harm to the host system. This intermediary enables safe, rapid analysis of potentially malicious code while maintaining detection accuracy.
2Reliability
If protective software is installed on host systems to detect malicious content, then detection capability is improved, but many hosts (medical devices, military systems, IoT devices) do not allow installation of such protective measures
Solution Approach 1:
The patent uses a virtual machine as an intermediary execution environment that can be deployed in restricted systems without requiring installation of traditional protective software. The virtual machine provides a sandboxed environment for safe code execution, making protection compatible with medical devices, military systems, and IoT devices that cannot have external software installed.
Solution Approach 2:
The virtual machine-based detection system provides universal protection across diverse platforms and restricted environments. Rather than requiring platform-specific protective software, the virtual machine approach works consistently across web browsers, mobile devices, IoT systems, and embedded systems, making the solution adaptable to environments with installation restrictions.
3Loss of time
If traditional detection methods are used, then analysis can be performed offline, but they are unable to provide timely protection against evolving threats
Solution Approach 1:
The patent enables continuous real-time detection by executing JavaScript code in a virtual machine as it encounters potentially malicious content during normal browsing. Rather than requiring periodic offline scanning, the system continuously monitors and analyzes code execution in real-time, providing immediate protection against evolving threats while maintaining operational simplicity through automatic background analysis.
4Measurement precision
If comprehensive analysis of JavaScript code is performed, then detection accuracy is improved, but the analysis process becomes slow and cannot keep up with the volume of JavaScript in modern WWW traffic
Solution Approach 1:
The patent replaces slow mechanical analysis methods with virtual machine-based execution, which can rapidly evaluate JavaScript code by actually running it in a controlled environment. This substitution maintains high detection accuracy through dynamic behavior analysis while achieving the processing speed necessary to handle the volume of JavaScript traffic in modern web environments.
Solution Approach 2:
The patent uses dynamic execution analysis within the virtual machine to achieve both accuracy and speed. Rather than performing static, time-consuming code review, the system dynamically executes the code and observes its behavior in real-time. This dynamic approach provides comprehensive analysis accuracy while maintaining high productivity by leveraging the virtual machine's efficient execution engine.
Data Source
AI summary
Systems and methods for detecting malicious or potentially malicious script data are provided. Script data is extracted from a data stream at the network level and emulated in a controlled environment. Based upon a comparison of features extracted from emulation of the script to a set of heuristics, malicious script data can be identified for further analysis or processing.