Proxy Script Detection via Normalization and Emulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are ineffective in quickly and accurately identifying and blocking malicious scripting languages, such as JavaScript or Flash, which are often encoded and dynamically morphed, leading to slow detection and unsuitable proxy-based implementations.
Innovation Solution
A system and method that involves a proxy intercepting webpage data, normalizing scripting-language-data, and using an inspection-point-script-execution engine to emulate execution, with a shellcode module disassembling and pseudo-executing code to determine whether to block the data, and an analysis component assessing the inspection data to prevent malicious scripts from reaching the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional malware detection techniques are used to identify malicious scripts, then detection accuracy may be maintained, but detection speed becomes too slow for proxy-based implementation
Solution Approach 1:
The detection system is divided into multiple specialized components: an initial filter for quick rejection of benign scripts, a normalization component for standardizing script formats, an inspection-point-script-execution engine for safe execution analysis, and a shellcode module for disassembly. This segmentation allows each component to optimize for its specific function, achieving both speed and accuracy.
Solution Approach 2:
The system performs preliminary normalization of scripting language data before execution analysis, converting encoded or dynamically morphed scripts into a standardized form. This preliminary action enables faster and more accurate detection by eliminating the need to analyze complex encoded variations during the main detection process.
2Measurement precision
If scripting language data is normalized and emulated for inspection, then detection accuracy improves, but processing time increases
Solution Approach 1:
The inspection-point-script-execution engine acts as an intermediary that emulates script execution in a controlled environment, collecting inspection data without actually executing harmful functions. This intermediary approach allows accurate analysis of script behavior while preventing real-world damage and maintaining relatively fast processing.
Solution Approach 2:
The system performs partial execution analysis by focusing on specific inspection points rather than complete script execution. The shellcode module disassembles and pseudo-executes only critical portions of the script, achieving sufficient detection accuracy without the time cost of full execution analysis.
3Measurement precision
If encoded and dynamically morphed scripts are analyzed in detail, then detection accuracy improves, but the complexity of the detection system increases
Solution Approach 1:
The system extracts and analyzes only the essential characteristics of scripts at inspection points rather than examining entire encoded scripts in detail. The normalization component extracts standardized representations, and the inspection engine focuses on critical execution paths, reducing system complexity while maintaining detection accuracy for encoded and morphed scripts.
Data Source
AI summary
Systems and methods for protecting client computers are described. One method includes receiving webpage data at a proxy from a webpage before the data reaches an intended recipient; gathering scripting-language-data from the webpage data; normalizing the scripting-language-data so as to generate normalized data; emulating execution of the normalized scripting-language-data with a inspection-point-script-execution engine that that is adapted to provide inspection points instead of effectuating particular functions, and determining whether to block the data from the intended recipient by analyzing inspection-data collected from the inspection points.