Obfuscated Script Malware Detection Using Modified Abstract Syntax Trees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems face challenges in efficiently detecting malware in obfuscated scripts due to high memory usage and processing requirements, which deplete resources needed for user activities, as they require separate emulators for each language and extensive sandbox analysis.
Innovation Solution
A system and method that utilizes a universal emulator to convert obfuscated scripts into modified abstract syntax trees (mAST) for analysis, enabling efficient malware detection across multiple languages without the need for resource-intensive sandboxing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anti-malware systems use separate emulators for each scripting language to detect malware, then detection accuracy is improved, but memory usage and processing resources increase significantly
Solution Approach 1:
The patent implements a universal emulator capable of executing multiple scripting languages (VBScript, JavaScript, PHP, Perl, Python, Ruby) through a single unified architecture. The emulator uses language-specific parsers and a common virtual machine to handle different script types, eliminating the need for separate emulator instances for each language. This multi-functional approach maintains comprehensive malware detection capability while significantly reducing memory consumption and processing overhead compared to having dedicated emulators for each scripting language.
2Reliability
If conventional systems perform extensive sandbox analysis on obfuscated scripts, then malware detection reliability is improved, but analysis time increases
Solution Approach 1:
The system performs preliminary static analysis on obfuscated scripts before executing them in the sandbox environment. The universal emulator parses the script structure, identifies suspicious patterns, and pre-evaluates potential malicious behaviors. This preliminary assessment allows the system to flag high-risk scripts for immediate quarantine without requiring full sandbox execution, thereby maintaining high detection reliability while significantly reducing the time spent on benign or low-risk scripts.
3Measurement precision
If separate emulator modules are used for each scripting language, then language-specific detection accuracy is improved, but device complexity increases
Solution Approach 1:
The universal emulator is segmented into modular components: language-specific parsers for different scripting languages, a common virtual machine for execution, and a unified analysis engine. Each parser is responsible for converting its specific language syntax into an intermediate representation that the virtual machine can execute. This segmentation allows the system to maintain high detection accuracy for each language while managing complexity through modular design, where each component has a specific, well-defined function rather than requiring a completely separate emulator for each language.
Data Source
AI summary
Disclosed herein are systems and method for detecting malware in obfuscated scripts. A method may include receiving the obfuscated script on a computing device written in a first coding language, wherein a malware scanner on the computing device is incompatible with the first coding language, identifying the first coding language based on detected keywords and operators in the obfuscated script, converting each line of the obfuscated script in the first coding language into a respective modified abstract syntax tree (mAST), receiving artifacts of the obfuscated script by executing at least one mAST using a universal emulator, scanning the artifacts for malware using the malware scanner; and in response to detecting the malware in the obfuscated script based on the scanning, performing a remediation action on the obfuscated script.