Script De-obfuscation via Syntax Tree Normalization for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious scripts, often obfuscated to evade detection, pose a significant threat to computing devices by exploiting vulnerabilities and compromising security, with existing technologies struggling to effectively identify and prevent their execution.
Innovation Solution
A method and device that intercept and analyze script-containing data, normalize and de-obfuscate scripts, and match them against regular expression signatures to identify and prevent the delivery of malicious scripts to end-point devices, utilizing syntax tree generation, whitespace and identifier normalization, and emulated environment tracing to detect malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If scripts are obfuscated to evade detection, then the malicious script can bypass security measures, but detection accuracy decreases
Solution Approach 1:
The script is segmented into multiple components including syntax tree generation, normalization stages (whitespace, identifiers, comments), and signature matching. This segmentation allows each component to handle specific aspects of obfuscation independently, improving detection accuracy without overwhelming the system with monolithic complexity
Solution Approach 2:
A normalization intermediary layer is introduced between the raw obfuscated script and the signature matching process. This intermediary standardizes the script by removing obfuscation elements (whitespace, identifiers, comments) while preserving functional semantics, enabling accurate detection without directly confronting the complexity of obfuscated variants
2Measurement precision
If comprehensive script analysis is performed to detect obfuscated malicious code, then detection accuracy improves, but processing time increases
Solution Approach 1:
Normalization operations (whitespace removal, identifier standardization, comment stripping) are performed as preliminary actions before signature matching. This preparation work is done once on the raw script, transforming it into a standardized form that enables faster and more accurate signature comparison in subsequent operations
Solution Approach 2:
The script's parameters are changed from their original obfuscated state to a normalized state through systematic transformations. By changing whitespace patterns, identifier names, and comment structures to standardized forms, the script becomes comparable against signatures without requiring time-consuming analysis of each obfuscation variant
3Measurement precision
If normalization operations are applied to de-obfuscate scripts, then signature matching accuracy improves, but computational overhead increases
Solution Approach 1:
Non-essential elements that contribute to obfuscation but not to script functionality are extracted and removed during normalization. Whitespace, comments, and non-critical identifiers are taken out of the script, reducing the data volume that requires computational processing while preserving the core functional logic needed for accurate signature matching
Solution Approach 2:
Instead of trying to match signatures against all possible obfuscated variants of a script (which would be computationally expensive), the approach is inverted: the script is normalized to a single standard form, and signatures are matched against this standardized version. This inversion reduces computational overhead by eliminating the need to generate and compare multiple obfuscated variants
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A device receives data, identifies a context associated with the data, and identifies a script, within the data, associated with the context. The device parses the script to identify tokens, forms nodes based on the tokens, and assembles a syntax tree using the nodes. The device renames one or more identifiers associated with the nodes and generates a normalized text, associated with the script, based on the syntax tree after renaming the one or more identifiers. The device determines whether the normalized text matches a regular expression signature and processes the data based on determining whether the normalized text matches the regular expression signature. The device processes the data by a first process when the normalized text matches the regular expression signature or by a second process, different from the first process, when the normalized text does not match the regular expression signature.