Run-Time Attack Prevention via Function Override and Argument Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional signature-based detection methods are ineffective against obfuscated malicious code, particularly in JavaScript, which can evade detection until runtime, and can be hidden in trusted sources, posing a challenge for web site operators to protect their visitors from such attacks.
Innovation Solution
A system and method for run-time attack prevention that intercepts and modifies executable content by adding protections that override vulnerable functions, analyzing arguments for threats, and terminating execution if a threat is detected, while also alerting administrators or users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used to identify malware, then detection capability is improved, but it becomes ineffective against obfuscated malicious code such as JavaScript that can evade detection until runtime
Solution Approach 1:
The patent applies preliminary action by inserting protection code into web content before it reaches the user's browser. This protection code establishes a secure execution environment and overrides vulnerable functions in advance, preventing malicious code from executing harmful operations even if the malware itself is not detected. The protection is proactively applied to all JavaScript content, creating a preventive barrier before runtime execution.
Solution Approach 2:
The patent uses an intermediary approach by introducing a protection mechanism that sits between the web content and the browser's JavaScript engine. This intermediary protection code monitors and controls the execution of JavaScript functions, particularly those that could expose vulnerabilities. When malicious code attempts to execute, the intermediary protection detects and blocks it, allowing legitimate code to function normally while preventing attacks.
2Reliability
If protections are added to override vulnerable functions in web content, then attack prevention is improved, but complexity of the system increases
Solution Approach 1:
The patent applies segmentation by dividing the protection mechanism into distinct functional components: (1) protection code insertion module that embeds protection into web content, (2) function override module that intercepts vulnerable functions, (3) monitoring module that detects malicious execution patterns, and (4) response module that blocks attacks. Each component handles a specific aspect of the protection process, making the overall system more manageable and maintainable despite its complexity.
Solution Approach 2:
The patent implements universality by creating a multi-functional protection system that can handle multiple types of threats through a single unified mechanism. The protection code is designed to work across different browsers and operating systems, and can protect against various JavaScript-based attacks using the same core approach of function overriding and execution monitoring. This universal solution reduces the need for multiple specialized protection systems.
3Measurement precision
If run-time monitoring and function overriding is implemented, then detection of obfuscated malware is improved, but processing time and performance may be degraded
Solution Approach 1:
The patent applies partial action by implementing selective monitoring of JavaScript functions rather than monitoring all code execution equally. The protection mechanism focuses on overriding and monitoring specific vulnerable functions that are most likely to be used in attacks, such as those related to file system access, network communication, and system commands. Less critical functions receive minimal or no monitoring, reducing the overall processing overhead while maintaining security for the most important vulnerability points.
Data Source
AI summary
Preventing attacks on a computer at run-time. Content that is configured to access at least one function of a computer is received by the computer. Protections corresponding to the function are added to the content, wherein the protections override the function. The content and the protections are then transmitted to the computer. The function may expose a vulnerability of the computer, and arguments passed to the function may exploit that vulnerability. The protections are executed when the content is executed, and determine whether the arguments the content passed into the function represent a threat. In response to determining that the arguments represent a threat, execution of the content is terminated without executing the function.