Obfuscated Script Malware Detection Using a Universal Emulator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems face challenges in efficiently detecting malware in obfuscated scripts due to high memory usage and processing requirements, which deplete resources needed for user activities, and require separate emulators for each programming language, making detection inefficient and resource-intensive.
Innovation Solution
A system and method that utilizes a universal emulator to convert obfuscated scripts into modified abstract syntax trees (mAST) for analysis, enabling efficient malware detection across multiple languages without the need for separate emulators, thus reducing resource consumption and enabling inline detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional anti-malware systems use separate emulators for each programming language to detect malware, then detection capability across multiple languages is improved, but device complexity and resource consumption increase significantly
Solution Approach 1:
The patent implements a universal emulator that can execute multiple programming languages (JavaScript, PHP, Python, Ruby, Perl) through a single unified interface. This universal emulator replaces the need for multiple separate language-specific emulators, reducing system complexity while maintaining the ability to detect malware across different scripting languages. The universal emulator achieves this by implementing a common execution environment that can interpret various language syntaxes without requiring separate emulator instances for each language.
2Reliability
If conventional anti-malware systems analyze obfuscated scripts using multiple language-specific emulators, then detection accuracy is improved, but memory usage and processing power increase substantially
Solution Approach 1:
The patent merges multiple language-specific emulator functions into a single universal emulator that handles JavaScript, PHP, Python, Ruby, and Perl through one unified execution environment. This consolidation reduces memory usage and processing overhead compared to running separate emulator instances for each language, while maintaining detection accuracy through comprehensive artifact analysis and behavioral monitoring.
Solution Approach 2:
The patent creates a virtualized execution environment that copies the essential runtime behaviors of multiple programming languages into a single emulator framework. This allows the universal emulator to simulate different language executions without requiring actual language-specific runtime environments, reducing resource consumption while preserving detection capabilities.
3Reliability
If conventional systems use sandbox solutions for malware detection, then detection reliability is improved, but detection time and resource requirements increase
Solution Approach 1:
The patent performs preliminary analysis by executing the obfuscated script in the universal emulator before final malware determination. This preliminary execution in a controlled environment allows the system to observe behavioral patterns, generate artifacts, and identify suspicious activities early in the analysis process, reducing the time needed for comprehensive malware detection compared to traditional sandbox approaches that require full script execution.
Solution Approach 2:
The patent implements partial execution monitoring where the universal emulator tracks specific artifacts and behavioral patterns during script execution without requiring complete script completion. This partial action approach allows the system to detect malware indicators early in the execution process, reducing detection time while maintaining reliability through targeted artifact analysis.
Data Source
AI summary
A system receives, on a computing device, the obfuscated script written in a first coding language that is incompatible with a malware scanner on the computing device. The system converts each line of the obfuscated script in the first coding language into a respective logical tree. The system receives artifacts of the obfuscated script by executing at least one logical tree using a universal emulator. The system scans the artifacts for malware using the malware scanner. The system in response to detecting the malware in the obfuscated script based on scanning the artifacts, performs a remediation action on the obfuscated script.