Script Execution Flow Fingerprinting for Zero-Day Malware Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data security systems are reactive and fail to prevent malicious script executions, particularly for zero-day vulnerabilities, leaving computing devices at risk of harm due to undetected security flaws.
Innovation Solution
A method and system for detecting malware in scripts by monitoring execution flows, computing fingerprints, and comparing them against local and universal databases to block malicious scripts, with a proactive defense module and central database server for updating and sharing detection rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware scanners are used, then detection of known malware is possible, but detection of zero-day attacks and malicious scripts is failed
Solution Approach 1:
The patent changes the detection parameter from static code analysis to dynamic execution flow analysis. By monitoring the actual runtime behavior and sequence of operations rather than relying on pre-defined malware signatures, the system can detect previously unknown malicious scripts that exhibit characteristic harmful execution patterns.
Solution Approach 2:
The system performs preliminary monitoring and fingerprinting of execution flows before malware can cause significant harm. By establishing baseline execution patterns and comparing actual runtime behavior against these patterns, the system proactively identifies malicious activity before it completes its harmful objective.
2Loss of information
If reactive malware detection is implemented, then known malware can be identified after execution, but prevention of malicious script execution is not achieved
Solution Approach 1:
The patent implements a feedback mechanism where execution flow data is continuously monitored, analyzed, and used to update detection rules in real-time. The system compares actual execution patterns against known benign patterns and adjusts its blocking decisions based on this continuous feedback loop, enabling both rapid detection and prevention.
Solution Approach 2:
The system replaces traditional mechanical scanning approaches with automated dynamic analysis. Instead of statically examining code files, the system substitutes runtime execution monitoring that automatically captures, analyzes, and responds to malicious behavior patterns as they occur during actual script execution.
3Productivity
If execution flow monitoring and fingerprinting is implemented, then rapid detection of malicious scripts is achieved, but system complexity increases
Solution Approach 1:
The patent extracts only the essential characteristics of execution flows into compact fingerprints. By identifying and isolating key operational sequences and behavioral patterns rather than analyzing entire execution traces, the system achieves rapid comparison and detection while maintaining manageable complexity through focused feature extraction.
Solution Approach 2:
The system creates simplified copies of execution flow data in the form of fingerprints and hashes. These compact representations allow for rapid comparison against databases of known benign and malicious patterns without requiring storage or processing of complete execution traces, thereby maintaining high detection speed with reduced computational overhead.
Data Source
AI summary
Disclosed herein are systems and methods for detecting malware in scripts. A method includes: monitoring, at a first computing device, an execution flow of at least one portion of a script; computing a fingerprint that represents the execution flow; determining whether the fingerprint is present in a local fingerprint database that includes a plurality of entries for known scripts; in response to determining that the fingerprint is not present in the local fingerprint database, transmitting the fingerprint to a central database server including a universal fingerprint database; in response to receiving an indication that the fingerprint is not present in the universal fingerprint database, scanning the at least one portion of the script for malware; and blocking the script in response to determining that the at least one portion of the script includes malware based on the scanning.