Script Code Combining for Malicious Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional methods fail to detect malicious JavaScript codes that are finely divided or dynamically generated, as they are unable to acquire sufficient feature values for classification, and often combine unnecessary dummy codes, making it difficult to analyze such codes.

Innovation Solution

A combining apparatus and method that integrates a code combining unit to combine divided script codes based on data dependencies and dynamic generation relations, forming a more meaningful and larger code size that can be analyzed, enabling effective detection of malicious scripts.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional analysis methods are used on divided script codes, then analysis simplicity is maintained, but detection capability deteriorates because sufficient feature values cannot be acquired

Engineering Contradiction:
Improvedetection capabilityVSAvoidcode processing complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent combines multiple divided script codes into a unified code structure by establishing data dependencies and execution sequences between them. This merging process creates a complete code representation that provides sufficient feature values for detection while maintaining manageable analysis complexity through systematic integration.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The patent performs preliminary actions by pre-establishing data dependencies and execution sequences among divided script codes before analysis. This preliminary structuring enables subsequent detection processes to work with organized, interconnected code representations rather than isolated fragments, improving feature extraction effectiveness.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If all script codes are combined indiscriminately, then code size increases for better analysis, but unnecessary dummy codes are included reducing analysis quality

Engineering Contradiction:
Improveanalysis qualityVSAvoidcode volume
Core Design Contradiction:
Measurement precisionVSQuantity of substance

Solution Approach 1:

The patent extracts and identifies dummy codes from the combined script codes by analyzing data dependencies and execution sequences. Once identified, these unnecessary codes are excluded from the final analysis set, ensuring that only meaningful code segments are processed. This extraction process maintains high analysis quality while reducing code volume by removing irrelevant content.

Inventive Principle:
Principle #2Taking out (Extraction)

3Measurement precision

If divided script codes are analyzed separately, then analysis speed is maintained, but detection accuracy deteriorates due to insufficient feature values

Engineering Contradiction:
Improvedetection accuracyVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent merges divided script codes into a structured unified representation that preserves execution sequences and data dependencies. This merging enables the system to analyze codes more efficiently by processing interconnected segments together rather than separately, improving detection accuracy through comprehensive feature extraction while managing analysis time through systematic organization.

Inventive Principle:
Principle #5Merging (Combining)

Data Source

PatentEP3547121B1Combining device, combining method and combining program
Publication Date: 2023.11.15 NIPPON TELEGRAPH & TELEPHONE CORP
  • EP3547121B1 patent drawingFigure 1
  • EP3547121B1 patent drawingFigure 2
  • EP3547121B1 patent drawingFigure 3

AI summary

A combining apparatus (10) has: an acquiring unit (141) that acquires script codes included in a website and having been divided and written at plural locations in the website; and a code combining unit (142) that combines a plurality of the divided script codes written therein, based on a dependency between data in the divided script codes written therein acquired by the acquiring unit (141), or a dynamic generation relation arising from execution of the divided script codes written therein.