Script Whitelisting at Launch and Module Import Against Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing whitelisting methods fail to effectively detect and block script-based malicious programs, particularly those lacking file extensions or shebangs, leaving systems vulnerable.
Innovation Solution
A whitelisting method that checks script files at two interception points during execution: before launch and during module import, using interpreter and module loader programs to verify against a whitelist, blocking unauthorized script execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional whitelisting methods are used, then general malicious programs can be blocked, but script-based malware without file extensions or shebangs cannot be detected
Solution Approach 1:
The system performs preliminary detection at two interception points: before the interpreter process launches the script file, and before the module loader imports the script file. By checking the whitelist in advance at these critical moments, the system prevents script-based malware from executing or being imported, thereby improving detection reliability without requiring complex runtime analysis
Solution Approach 2:
The patent introduces a whitelist checking mechanism as an intermediary between the interpreter/module loader and the script files. This intermediary layer verifies whether script files should be allowed to execute or be imported by checking them against the whitelist, effectively blocking script-based malware while permitting legitimate scripts
2Reliability
If whitelist checking is performed at multiple interception points, then script-based malware is effectively blocked, but system performance decreases due to additional verification steps
Solution Approach 1:
The system performs whitelist checking in advance at two critical interception points: before the interpreter process launches the script file, and before the module loader imports the script file. By verifying script files beforehand, the system ensures that only authorized scripts are executed or imported, thereby achieving accurate script execution control without requiring complex runtime analysis
Solution Approach 2:
The patent applies whitelist checking selectively at two specific interception points rather than continuously monitoring all script operations. This partial action approach focuses security verification only at critical moments when scripts are launched or imported, ensuring security accuracy while minimizing the performance overhead compared to continuous monitoring
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A whitelisting method for blocking script-based malware includes steps of: checking a command line of a process to confirm the process to launch a first interception point of a startup script file; checking whether the startup script file in a whitelist at the first interception point; determining that a test is passed when the startup script file exists in the whitelist, and launching the startup script file, wherein the startup script file at least includes a module script file; confirming the process to invoke a module loader to import and launch a second interception point of the module script file; checking whether the module loader is allowed to import the module script file, or is allowed to launch the module script file that has been imported by using the whitelist at the second interception point.