Script Execution Blocking via Bytecode Hash Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are ineffective in detecting and blocking new or obfuscated malicious scripts, particularly those composed of multiple files with varying malicious functionalities, which poses a significant challenge in protecting computer systems from unknown malware threats.
Innovation Solution
A system and method that intercepts script requests, generates bytecode, computes hash sums, determines similarity with stored malicious and clean scripts, and blocks execution based on trust coefficients, utilizing fuzzy hashing and search techniques to identify and prevent malicious script execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions detect and remove known malware, then security against known threats is improved, but effectiveness against new or obfuscated malicious scripts deteriorates
Solution Approach 1:
The patent transforms the script into bytecode representation and computes hash sums, changing the parameter form from source code to executable instructions. This enables detection based on functional behavior rather than code structure, allowing identification of obfuscated or new malware that performs similar operations. The bytecode conversion creates a standardized form that reveals functional similarities across different script variants.
Solution Approach 2:
The patent replaces traditional signature-based detection mechanisms with a behavioral analysis system using bytecode comparison. Instead of matching known malware patterns, the system analyzes the functional operations of scripts through their bytecode representation, substituting static pattern matching with dynamic functional analysis to detect unknown threats.
2Measurement precision
If security solutions analyze script behavior to detect malware, then detection accuracy is improved, but system performance and processing speed deteriorate
Solution Approach 1:
The patent extracts only the essential functional operations from scripts by converting them to bytecode and computing hash sums. This extraction process isolates the core behavioral characteristics needed for detection while discarding unnecessary code details, enabling fast comparison and analysis. The bytecode representation captures functional essence without requiring full script interpretation.
Solution Approach 2:
The transformation to bytecode and hash sum computation changes the data parameters from complex script text to compact numerical representations. This parameter transformation enables efficient storage, rapid comparison, and scalable analysis, improving processing speed while maintaining detection precision through the preservation of functional behavior in the bytecode form.
3Adaptability or versatility
If fuzzy hashing is used to identify similar scripts, then detection of obfuscated malware is improved, but computational complexity increases
Solution Approach 1:
The patent creates simplified copies of scripts in bytecode form that preserve functional characteristics while reducing complexity. These bytecode copies serve as lightweight representations that can be rapidly compared using hash sums, enabling detection of obfuscated malware without requiring full analysis of complex original scripts. The copying process maintains essential behavioral patterns in a computationally efficient format.
Data Source
AI summary
Disclosed are exemplary aspects of systems and methods for blocking execution of scripts. An exemplary method comprises: intercepting a request for a script from a client to a server; generating a bytecode of the intercepted script; computing a hash sum of the generated bytecode; determining a degree of similarity between the hash sum of the bytecode and a plurality of hash sums of malicious and clean scripts stored in a database; identifying a similar hash sum from the database whose degree of similarity with the hash sum of the bytecode is within a threshold of similarity; determining a coefficient of trust of the similar hash sum; determining whether the requested script is malicious based on the degree of similarity and the coefficient of trust of the similar hash sum; and blocking the execution of the malicious script on the client.