Script Evaluation Engine for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to detect malicious scripting language code, particularly JavaScript, due to its dynamic nature and evasion techniques, which can bypass signature detection methods.
Innovation Solution
A communication system that includes a security device with a script evaluation engine, function evaluation module, and post evaluation module to detect and analyze JavaScript code by applying heuristics during compilation and execution, identifying evasion techniques and correlating events to determine malicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature detection methods are used to scan executable software files, then known malicious code can be detected, but malicious scripting language code using evasion techniques cannot be detected
Solution Approach 1:
The system dynamically compiles and executes scripting language code in a sandboxed environment, allowing the detection mechanism to adapt to the dynamic and obfuscated nature of malicious scripts. Instead of relying on static signatures, the system evaluates the actual runtime behavior of the code, making it effective against both known and unknown malicious scripts.
Solution Approach 2:
A sandboxed execution environment acts as an intermediary between the untrusted scripting code and the host system. This isolated environment allows safe execution and observation of script behavior without risking the security of the main system, enabling detection of malicious actions while maintaining system integrity.
2Productivity
If static signature scanning is performed on files, then the scanning process is simple and fast, but it fails to detect obfuscated and dynamic scripting code
Solution Approach 1:
The system performs preliminary compilation of the scripting code before execution in the sandbox. This compilation step transforms the obfuscated script into an executable form, allowing the system to observe the actual runtime behavior and detect malicious intentions that would be invisible in the original obfuscated code.
Solution Approach 2:
The system replaces the mechanical signature-matching approach with a behavioral analysis approach. Instead of mechanically comparing code patterns against known signatures, the system executes the code and observes its runtime behavior, detecting malicious actions based on what the code actually does rather than what it looks like.
3Reliability
If scripting code is executed in a sandboxed environment with compilation and evaluation, then malicious behavior can be detected, but the processing time and system complexity increase
Solution Approach 1:
The detection system is segmented into distinct functional modules: a sandboxed execution environment, a compilation module, an event monitoring module, and a correlation analysis module. This segmentation allows each component to perform its specific function efficiently and makes the overall system more manageable and maintainable despite its complexity.
Solution Approach 2:
The system implements feedback mechanisms where execution events are monitored and correlated to determine whether malicious behavior has occurred. The correlation analysis module receives feedback from multiple event sources and uses this information to make detection decisions, creating a closed-loop system that continuously refines its detection accuracy.
Data Source
AI summary
A method is provided in one example embodiment and includes initiating an execution of a compiled script, evaluating a function called in the compiled script, detecting an execution event based on at least a first criterion, and storing information associated with the execution event in an execution event queue. The method also includes verifying a correlation signature based on information associated with at least one execution event in the execution event queue. In specific embodiments, the method includes evaluating an assignment statement of a script during compilation of the script by a compiler, detecting a compilation event based on at least a second criterion, and storing information associated with the compilation event in a compilation event queue. In yet additional embodiments, the verification of the correlation signature is based in part on information associated with one or more compilation events in the compilation event queue.