Script Whitelisting at Startup and Module Import Interception Points
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing whitelisting methods fail to effectively block script-based malware, as they either lack protection for individual scripts or cannot detect malicious scripts without shebang or file extensions, leaving systems vulnerable.
Innovation Solution
A whitelisting method that checks script files at two interception points: the first before launching a startup script file and the second before importing a module script file, using a whitelist to verify the legitimacy of these files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional whitelisting methods are used, then general malicious programs can be blocked, but script-based malware without shebang or file extensions cannot be detected
Solution Approach 1:
The patent segments the script execution process into multiple interception points: (1) command line parsing stage to detect startup scripts, (2) module loading stage to detect imported scripts. This segmentation allows comprehensive detection of script-based malware at different execution phases, overcoming the limitation of traditional single-point whitelisting methods.
Solution Approach 2:
The patent performs preliminary detection and validation of script files before they are executed. By intercepting and checking scripts at the command line parsing stage and module loading stage before actual execution, the system prevents malicious scripts from running, thereby improving reliability without sacrificing detection coverage.
2Reliability
If comprehensive script detection is implemented, then script-based malware can be blocked, but system performance and execution speed may be reduced
Solution Approach 1:
The patent performs whitelist validation in advance at interception points before script execution. By pre-checking whether scripts exist in the whitelist database and validating their legitimacy before allowing execution, the system ensures comprehensive malware blocking while minimizing performance impact during actual script runtime.
Solution Approach 2:
The patent introduces an intermediary whitelist validation mechanism between the script execution request and the actual script runtime. This intermediary layer checks script legitimacy without requiring deep analysis of script content during execution, thereby maintaining system execution speed while ensuring security.
3Measurement precision
If multiple interception points are added for script validation, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent divides script validation into segmented interception points corresponding to natural phases of script execution: command line parsing, module loading, and script runtime. Each interception point handles specific validation tasks, improving detection accuracy while keeping each segment's complexity manageable through clear separation of concerns.
Data Source
AI summary
A whitelisting method for blocking script-based malware includes steps of: checking a command line of a process to confirm a first interception point that the process launches a startup script file; checking whether the startup script file in a whitelist at the first interception point; determining that a test is passed when the startup script file exists in the whitelist, and launching the startup script file, wherein the startup script file at least includes a module script file; confirming a second interception point that the process invokes a module loader to import and launch the module script file; checking whether the module loader is allowed to import the module script file, or is allowed to launch the module script file that has been imported by using the whitelist at the second interception point.