Script Normalization for Malware Detection Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware detection systems face difficulties in identifying malicious scripts due to obfuscation techniques used by malware authors, which make it hard to detect all versions of malicious scripts effectively.
Innovation Solution
A method and system for normalizing scripts by removing duplicate whitespace and translating characters to a single case, followed by pattern matching to identify known malicious patterns, and generating a hash value for comparison with known malware, to improve detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If obfuscation techniques are used by malware authors, then the script can evade detection, but the detection accuracy decreases
Solution Approach 1:
The patent extracts and removes obfuscation elements (comments, whitespace, case variations) from the script to obtain a normalized core representation. This allows the detection system to focus on the essential malicious functionality while ignoring obfuscation noise, thereby maintaining high detection accuracy even against obfuscated malware.
Solution Approach 2:
The patent applies parameter changes by normalizing the script through standardized transformations: converting to a single case, removing duplicate whitespace, and standardizing comment formats. These parameter changes create a consistent representation that enables reliable pattern matching regardless of the original obfuscation style.
2Adaptability or versatility
If multiple versions of malicious scripts are created through polymorphism, then the malware can adapt, but the detection complexity increases
Solution Approach 1:
The patent extracts the essential functional elements from diverse script versions by removing variable naming, comments, and formatting differences. This extraction process reveals the common malicious pattern underlying all polymorphic variants, allowing a single detection model to handle multiple versions without increasing complexity.
Solution Approach 2:
The normalized script representation serves as a universal form that can detect all polymorphic variants of a malicious script. By transforming diverse scripts into a standardized format, the detection system achieves multi-functionality where one detection mechanism can identify multiple versions of the same malware family.
3Reliability
If script normalization processing is applied, then the detection accuracy improves, but the processing time increases
Solution Approach 1:
The patent segments the normalization process into simple, discrete operations: removing comments, collapsing whitespace, converting case, and standardizing delimiters. These segmented operations are computationally lightweight and can be applied quickly to scripts, improving accuracy without significant time penalty.
Solution Approach 2:
The normalization transformations are applied as preliminary actions before pattern matching. By pre-processing the script into a standardized form, the subsequent pattern matching operation becomes more efficient and accurate, reducing the overall detection time compared to analyzing obfuscated scripts directly.
Data Source
AI summary
Systems and methods normalize an executable script. A file can be received that potentially contains an executable script. The characters in the file are translated to a single case (either upper case or lower case). Duplicate whitespace can be removed. A script is identified within the file. Tokens in the script are processed to create normalized output. The normalized output can include tokens that are retained keywords, control flow characters or data characters from the script file.