Operation-Attribute Hashing for Generalized Malicious Script Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data security systems are reactive and fail to prevent malicious script executions, allowing harmful scripts to execute and potentially harm computing devices.
Innovation Solution
A method and system that proactively block malicious script execution by generating a hash value from script operation attributes, creating a rule to prevent matching scripts, and synchronizing this rule across computing devices to block execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus and malware scanners are used to detect malicious activity, then detection capability is provided, but the system remains reactive and cannot prevent malicious executions before damage occurs
Solution Approach 1:
The system performs preliminary action by proactively blocking script executions that match malicious patterns before they can complete harmful operations. Instead of waiting for damage to occur and then detecting it, the system establishes blocking rules in advance based on identified malicious execution patterns, thereby preventing the time loss associated with reactive detection.
Solution Approach 2:
The system applies preliminary anti-action by creating blocking rules that counteract potential malicious script executions before they can cause harm. The blocking mechanism is prepared in advance and actively prevents malicious patterns from executing, rather than merely detecting them after the fact.
2Adaptability or versatility
If script execution is blocked based on specific script names and locations, then precise blocking is achieved, but the system cannot generalize to block similar malicious scripts across different devices
Solution Approach 1:
The system uses copying by creating blocking rules that replicate the protective pattern across multiple devices. Instead of analyzing each script individually on each device, the system copies the blocking rule derived from one malicious script to prevent similar scripts across the entire network, thereby achieving adaptability without proportional increases in complexity.
Solution Approach 2:
The system achieves universality by creating generalized blocking rules that can apply across multiple devices and script variations. The blocking mechanism is designed to be device-agnostic and pattern-based, allowing a single rule to serve multiple protective functions across different computing environments.
3Measurement precision
If the system analyzes complete script code including names and locations to generate blocking rules, then accurate identification is achieved, but the rules cannot be generalized to block renamed or relocated malicious scripts
Solution Approach 1:
The system applies taking out by extracting only the essential malicious operational patterns from the complete script code, while deliberately excluding non-essential elements like script names and file locations. This extraction process isolates the core harmful behavior, allowing accurate identification of malicious intent while enabling generalization to renamed or relocated scripts.
Solution Approach 2:
The system uses parameter changes by transforming the blocking rule parameters from specific identifiers (script names, locations) to generalized operational patterns. This parameter transformation maintains measurement precision for detecting malicious behavior while improving adaptability to variations in script identity and location.
Data Source
AI summary
Disclosed herein are systems and method for blocking malicious script execution. In one exemplary aspect, the method includes determining, on a first computing device of a plurality of computing devices, that a first script on the first computing device is malicious. The method includes identifying a plurality of operations in an execution flow of the first script and generating a first hash value of attributes associated with the plurality of operations in the execution flow, wherein the attributes omit a name of the first script and a location of the first script on the first computing device. The method includes generating a first rule that prevents execution of any script whose generated hash value would match the first hash value of the first script and transmitting the first rule to a second computing device that subsequently blocks scripts based on the first rule.