Script Engine Hooks for Long-Loop Malicious Script Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing malicious scripts are hindered by code obfuscation and long loops, which cause delays or infinite loops, preventing comprehensive analysis of all execution paths, especially when conditions are not met or when analysis interference occurs.
Innovation Solution
An analysis function providing method that analyzes the virtual machine of a script engine, detects instruction sequences with repeated execution exceeding a threshold, and applies hooks to rewrite conditional branches, thereby suppressing delays or stops due to long loops.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic analysis is used to analyze malicious scripts, then execution behavior can be monitored, but execution may be delayed or stopped by long loops
Solution Approach 1:
The analysis device performs preliminary analysis to identify long loop structures in the malicious script before executing them. By detecting patterns such as repeated instruction sequences and loop conditions in advance, the device can prepare to intervene when these loops are encountered during dynamic analysis, preventing execution delays or infinite loops from compromising the analysis process
Solution Approach 2:
The analysis device acts as an intermediary between the malicious script execution and the analysis system. When a long loop is detected, the device intervenes by controlling the execution flow, allowing it to skip or limit the execution of problematic loop sections while still capturing relevant behavioral information. This intermediary role prevents the long loop from causing execution delays without completely blocking the analysis of malicious behavior
2Reliability
If multipath execution is used to capture all execution paths, then comprehensive analysis is achieved, but device complexity increases
Solution Approach 1:
The analysis device segments the malicious script execution into multiple independent paths, each representing a different execution flow. By identifying branch points and creating separate execution paths for each possible outcome, the device can systematically explore all potential behaviors without requiring a single complex multipath execution engine. This segmentation approach divides the complex task into manageable pieces that can be analyzed individually
Solution Approach 2:
The analysis device dynamically adapts its execution strategy based on the script's structure and behavior. Rather than pre-defining all possible paths, the device monitors execution in real-time and dynamically creates new paths when branch conditions are encountered. This dynamic approach allows the system to handle complex scripts flexibly without requiring predetermined knowledge of all execution paths, reducing overall system complexity
3Productivity
If static analysis is used to analyze script code, then analysis speed is improved, but code obfuscation prevents accurate analysis
Solution Approach 1:
The analysis device merges static analysis and dynamic analysis into a unified approach. Static analysis is performed first to quickly identify suspicious patterns, obfuscated code sections, and potential long loops. Then dynamic analysis is applied to verify and elaborate on findings from static analysis. This combination allows the device to maintain high productivity through static analysis while achieving high accuracy through dynamic verification, overcoming the limitations of using either method alone
Data Source
AI summary
An analysis function providing method executed by an analysis function providing device includes first analyzing a virtual machine of a script engine and acquiring a virtual program counter that is a variable indicating an instruction of the virtual machine to be executed next and a conditional branch flag that is an area for holding a flag as to whether or not branch is made at a time of conditional branch in an execution state, and providing an analysis function to the script engine by applying a hook including processing of detecting an instruction sequence a number of times of repeated execution of which is greater than or equal to a threshold and stopping execution of the instruction sequence by rewriting a condition related to a conditional branch at an end of the instruction sequence on a basis of the virtual program counter and the conditional branch flag.