Script Analysis Platform for Malicious Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anti-malware devices struggle to detect malicious scripts with polymorphic properties that use runtime environment calls and self-modifying code, leading to resource wastage and infection, as traditional signature-based analysis methods are ineffective against evolving and obfuscated threats.
Innovation Solution
A script analysis platform that parses scripts to generate a data structure, traverses it to determine functions and properties of expressions, evaluates constant sub-expressions, and analyzes these properties to identify malicious behavior, allowing for timely action to prevent spread and resource conservation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based analysis methods are used to detect malicious scripts, then detection of known malicious patterns is improved, but detection of polymorphic and obfuscated malicious scripts deteriorates
Solution Approach 1:
The patent transforms the detection approach by changing the analysis parameters from static signature matching to dynamic behavioral property analysis. It evaluates script properties such as runtime environment calls, self-modifying code patterns, and polymorphic characteristics, allowing the system to adapt to evolving threats while maintaining reliable detection of known malicious patterns
Solution Approach 2:
The patent introduces dynamic analysis capabilities that evaluate script behavior and properties rather than relying solely on static signatures. By analyzing runtime characteristics and behavioral patterns, the system becomes adaptable to polymorphic and obfuscated scripts while maintaining detection reliability through comprehensive property evaluation
2Reliability
If comprehensive script analysis is performed to identify malicious behavior, then detection capability is improved, but processing time and resource consumption increase
Solution Approach 1:
The patent applies partial analysis by evaluating specific behavioral properties and constant sub-expressions rather than performing exhaustive analysis of entire scripts. This selective approach to analyzing script properties enables timely detection of malicious behavior patterns without the excessive resource consumption of complete script execution or analysis
Solution Approach 2:
The patent extracts and evaluates only the critical behavioral properties and constant sub-expressions that indicate malicious behavior, rather than analyzing entire scripts in detail. This extraction of key diagnostic features enables rapid detection while minimizing processing time and resource requirements
3Adaptability or versatility
If behavioral property analysis is used instead of signature-based methods, then detection of polymorphic scripts is improved, but analysis complexity increases
Solution Approach 1:
The patent segments the script analysis into distinct evaluable properties such as runtime environment calls, self-modifying code detection, and constant sub-expression evaluation. This segmentation of complex analysis into discrete property evaluations simplifies the overall process while maintaining the ability to detect polymorphic and obfuscated scripts through systematic property assessment
Data Source
AI summary
A script analysis platform may obtain a script associated with content wherein the script includes one or more functions that include one or more expressions. The script analysis platform may parse the script to generate a data structure and may traverse the data structure to determine the one or more functions and to determine properties of the one or more expressions, wherein traversing the data structure includes evaluating one or more constant sub-expressions of the one or more expressions. The script analysis platform may analyze the properties of the one or more expressions to determine whether the script exhibits malicious behavior. The script analysis platform may cause an action to be performed concerning the script or the content based on determining whether the script exhibits malicious behavior.