Script Code Combining for Malicious Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to detect malicious JavaScript codes that are finely divided or dynamically generated, as they are unable to acquire sufficient feature values for classification, and often combine unnecessary dummy codes, making it difficult to analyze such codes.
Innovation Solution
A combining apparatus and method that integrates a code combining unit to combine divided script codes based on data dependencies and dynamic generation relations, forming a more meaningful and larger code size that can be analyzed, enabling effective detection of malicious scripts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional analysis methods are used on divided script codes, then analysis simplicity is maintained, but detection capability deteriorates because sufficient feature values cannot be acquired
Solution Approach 1:
The patent combines multiple divided script codes into a unified code structure by establishing data dependencies and execution sequences between them. This merging process creates a complete code representation that provides sufficient feature values for detection while maintaining manageable analysis complexity through systematic integration.
Solution Approach 2:
The patent performs preliminary actions by pre-establishing data dependencies and execution sequences among divided script codes before analysis. This preliminary structuring enables subsequent detection processes to work with organized, interconnected code representations rather than isolated fragments, improving feature extraction effectiveness.
2Measurement precision
If all script codes are combined indiscriminately, then code size increases for better analysis, but unnecessary dummy codes are included reducing analysis quality
Solution Approach 1:
The patent extracts and identifies dummy codes from the combined script codes by analyzing data dependencies and execution sequences. Once identified, these unnecessary codes are excluded from the final analysis set, ensuring that only meaningful code segments are processed. This extraction process maintains high analysis quality while reducing code volume by removing irrelevant content.
3Measurement precision
If divided script codes are analyzed separately, then analysis speed is maintained, but detection accuracy deteriorates due to insufficient feature values
Solution Approach 1:
The patent merges divided script codes into a structured unified representation that preserves execution sequences and data dependencies. This merging enables the system to analyze codes more efficiently by processing interconnected segments together rather than separately, improving detection accuracy through comprehensive feature extraction while managing analysis time through systematic organization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A combining apparatus (10) has: an acquiring unit (141) that acquires script codes included in a website and having been divided and written at plural locations in the website; and a code combining unit (142) that combines a plurality of the divided script codes written therein, based on a dependency between data in the divided script codes written therein acquired by the acquiring unit (141), or a dynamic generation relation arising from execution of the divided script codes written therein.