Script AST Cleanup for Precise Malicious Code Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting and removing malicious code in PHP or JavaScript scripts often result in false positives or negatives, compromising script functionality due to inaccurate pattern matching and behavior-based detection.
Innovation Solution
Utilizing Abstract Syntax Trees (ASTs) to identify and remove malicious code by determining the absolute position and length of parent operators in the AST, ensuring the structural integrity of the script is maintained.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If conventional pattern-matching techniques are used to detect malicious code, then detection speed is improved, but false positives and false negatives increase, compromising script functionality
Solution Approach 1:
The patent segments the script into an Abstract Syntax Tree (AST) structure, dividing the code into hierarchical nodes representing different linguistic elements. This segmentation allows precise identification of malicious patterns within specific tree nodes while preserving the overall script structure, thereby improving detection accuracy without sacrificing speed.
Solution Approach 2:
The patent introduces an AST as an intermediary representation between the original script and the detection mechanism. This intermediary structure enables accurate pattern matching by providing a structured view of the code, allowing detectors to identify malicious patterns while understanding their contextual relationships, thus reducing false positives and negatives.
2Object-affected harmful factors
If malicious code is removed using conventional methods, then the threat is neutralized, but script functionality is compromised due to syntax errors
Solution Approach 1:
The patent performs preliminary actions by generating an AST of the script before removing malicious code. This AST representation allows the system to understand the script's structural relationships in advance, enabling it to remove malicious patterns while automatically maintaining syntax integrity through the tree structure's inherent organizational logic.
Solution Approach 2:
The AST serves as an intermediary that guides the removal process. By working with the structured representation rather than the raw script, the system can identify and remove malicious nodes while automatically preserving the syntactic relationships needed for script functionality, thus neutralizing threats without compromising reliability.
3Measurement precision
If advanced heuristic analysis and behavior-based detection are used, then malicious code detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the detection task into structured AST node analysis, breaking down complex heuristic analysis into manageable tree traversal operations. This segmentation maintains high detection accuracy by systematically examining each node while reducing system complexity through the organized hierarchical structure, making the detection process more tractable and efficient.
Data Source
AI summary
Disclosed herein are systems and method for removing malicious code from a script without compromising script functionality. In one aspect, the method includes: identifying, in a script, at least one string corresponding to a malicious pattern; generating an abstract syntax tree (AST) of the script; identifying, in the AST, a parent operator associated with the at least one string; determining an absolute position and length of a node representing the parent operator in the AST; and removing malicious code from the script based on the absolute position and length of the node.