Malicious Script Detection Using Code Pattern and API Flow Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious scripts, such as signature-based scanning, are ineffective in real-time detection of new or unknown malicious scripts, as they rely on pre-extracted signatures and cannot identify scripts that have evolved or are written in various script languages.
Innovation Solution
An apparatus and system that utilize code pattern information and API flow information of previously-detected malicious scripts for real-time detection and prevention, employing both static and dynamic analysis to identify and block malicious scripts within web pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based scanning method is used to detect malicious scripts, then detection accuracy for known malicious codes is improved, but detection capability for new or unknown malicious scripts deteriorates
Solution Approach 1:
The patent segments the detection process into two distinct phases: static analysis (code pattern-based) and dynamic analysis (API flow-based). Static analysis extracts code patterns from malicious scripts to create signatures for quick matching, while dynamic analysis monitors API execution flows to detect previously unknown malicious behaviors. This segmentation allows the system to maintain high detection accuracy for known scripts while simultaneously adapting to new threats.
Solution Approach 2:
The system performs preliminary static analysis by extracting code patterns from malicious scripts before deployment. These pre-extracted code patterns and API flow signatures are stored and used for rapid comparison during real-time detection, enabling the system to quickly identify known malicious scripts while reserving computational resources for dynamic analysis of unknown threats.
2Measurement precision
If thorough pre-analysis process is performed to extract signatures, then detection precision for known malicious codes is improved, but processing time and system complexity increase
Solution Approach 1:
The patent divides signature extraction and detection into separate stages: an offline pre-analysis stage that extracts code patterns and API flow signatures from malicious scripts, and an online real-time stage that performs rapid pattern matching and dynamic monitoring. This segmentation allows thorough analysis to be performed beforehand without impacting real-time detection speed.
Solution Approach 2:
Code patterns and API flow signatures are extracted and prepared in advance during an offline pre-analysis process. These pre-computed signatures are stored in databases for rapid retrieval and comparison during real-time web page scanning, eliminating the need to perform thorough analysis during time-critical detection operations.
3Productivity
If static analysis only is used for real-time detection, then processing speed is improved, but detection capability for obfuscated or modified scripts deteriorates
Solution Approach 1:
The patent implements a two-layer detection architecture where static analysis (code pattern matching) serves as the first layer for rapid filtering of obviously malicious scripts, and dynamic analysis (API flow monitoring) serves as the second layer for deep inspection of suspicious or obfuscated scripts. This segmentation enables the system to maintain high processing speed while ensuring reliable detection of evolved threats.
Solution Approach 2:
The system dynamically adjusts its analysis approach based on initial static analysis results. Scripts that pass quick code pattern matching undergo further dynamic API flow monitoring, while clearly malicious scripts are blocked immediately. This dynamic, multi-stage approach optimizes both processing speed and detection reliability by applying appropriate analysis depth to each script.
Data Source
AI summary
Provided are an apparatus, a system and a method for detecting and preventing malicious scripts. The apparatus for detecting and preventing malicious scripts includes a signature management unit managing a first signature including code pattern information of previously-detected malicious scripts, a script analysis unit receiving the first signature from the signature management unit and analyzing a first script, which is included in a web page, using the first signature, and a script processing unit receiving analysis result data from the script analysis unit and processing the first script according to the analysis result data.