Runtime JavaScript Call Flow Graph for Malicious Script Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for securing web applications against script-based attacks, particularly malicious JavaScript attacks, are inadequate in continuously verifying supply chain attacks and executing malicious code, leading to vulnerabilities that can compromise sensitive information and system resources.
Innovation Solution
A Run-time, Web application-based, Self-Protection (RWASP) system that employs behavioral analysis of run-time JavaScript execution data using a client-side Call Flow Graph (CFG) to detect and mitigate script-based attacks, integrating a client-side component with a server-side detection and classification engine, recommendation engine, and policy engine for real-time threat detection and mitigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional web application security solutions (WAF, IPS) are used, then basic vulnerability protection is provided, but they cannot continuously verify supply chain attacks and execution of malicious code
Solution Approach 1:
The patent introduces a runtime instrumentation intermediary that sits between the web application and the user, capturing execution events without replacing existing security solutions. This intermediary layer enables continuous verification of supply chain attacks and malicious code execution while maintaining compatibility with traditional WAF and IPS systems, thus improving reliability without completely redesigning the security architecture
Solution Approach 2:
The security system is segmented into multiple independent components: runtime instrumentation module, event capture module, analysis engine, and response module. Each component performs a specific function in the security verification process, allowing the system to achieve continuous verification capability while maintaining manageable complexity through modular design
2Measurement precision
If runtime behavioral analysis is implemented, then detection of zero-day attacks and malware injections is improved, but processing overhead and system resource consumption increase
Solution Approach 1:
The system applies partial action by selectively instrumenting only critical code paths and functions that are most likely to be targeted by attacks. Rather than analyzing every single execution event in detail, the system focuses computational resources on high-risk areas, achieving high detection accuracy for zero-day attacks and malware while reducing overall processing overhead
Solution Approach 2:
The analysis engine dynamically adjusts analysis parameters such as sampling rate, depth of call stack traversal, and level of detail in event capture based on the perceived risk level and current system load. This allows the system to maintain high detection precision when threats are present while reducing processing overhead during normal operation
3Reliability
If comprehensive JavaScript execution monitoring is performed, then malicious script detection is enhanced, but impact on application performance and user experience increases
Solution Approach 1:
The monitoring system operates periodically rather than continuously, capturing execution events at strategically chosen intervals and at key checkpoints in the JavaScript execution flow. This periodic sampling approach provides sufficient protection against script attacks while minimizing the performance impact on application execution speed and user experience
Data Source
AI summary
A technique to detect script-based attacks. In this approach, behavioral analysis is performed against a traceable data structure, preferably in the form of a call flow graph (CFG) that is generated at an instrumented end user client browser. The CFG comprises a set of runtime script execution data points and one or more associated event chains that include the execution data points and their relative ordering. It is generated in a client browser in association with an interaction with a page, and it represents a context-based record of that specific interaction. By collecting similar CFGs from other such interactions with that page, the system identifies execution flow anomalies that represent malicious JavaScript attack(s). These attacks can then be mitigated, e.g., by updating the page or access policy associated with the page such that the attack cannot be successfully executed against other users interacting with the page.