Semi-Static JavaScript Classification for Fast Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in detecting malicious JavaScript code in real-time with high accuracy and low false positives, leading to potential delays and increased infection risks due to low scanning speed and outdated machine learning algorithms.
Innovation Solution
A real-time JavaScript classifier using a semi-static classifier that deobfuscates JavaScript content, employs classification features and models, and utilizes a Deep Neural Net trained with known benign and malicious content sources, along with a Discriminative Restricted Boltzmann Machine, to identify malicious objects quickly and accurately.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If real-time detection of malicious JavaScript is implemented, then detection speed is improved, but detection accuracy deteriorates
Solution Approach 1:
The detection system is divided into multiple independent modules: JavaScript deobfuscation module, feature extraction module, classification module, and sandbox execution module. Each module processes specific aspects of malicious code detection, allowing parallel processing and optimized performance for each function while maintaining overall detection accuracy through coordinated operation of all segments.
Solution Approach 2:
A sandbox environment is introduced as an intermediary between the detected JavaScript code and the host system. The sandbox safely executes deobfuscated code and captures behavioral features without risking the host system, enabling accurate detection of obfuscated malicious code while maintaining real-time protection capabilities.
2Reliability
If comprehensive scanning is performed to improve detection accuracy, then false positive rate is reduced, but scanning speed deteriorates
Solution Approach 1:
The system performs preliminary deobfuscation of JavaScript code before classification, transforming obfuscated code into readable form upfront. This preliminary processing enables more accurate feature extraction and classification in subsequent steps, improving detection reliability without significantly impacting overall scanning speed due to efficient preprocessing.
Solution Approach 2:
The detection system dynamically adjusts its scanning depth and methodology based on code characteristics. For high-risk patterns, comprehensive analysis is performed; for low-risk patterns, faster heuristic methods are used. This dynamic approach maintains high detection reliability for malicious code while preserving scanning speed through selective analysis intensity.
3Measurement precision
If advanced machine learning algorithms are used to improve detection accuracy, then detection rate is improved, but computational complexity increases
Solution Approach 1:
Traditional signature-based detection methods are replaced with machine learning-based classification algorithms. The system uses trained classifiers that automatically learn patterns from labeled datasets, substituting manual rule creation with adaptive computational models that improve detection accuracy while managing complexity through automated training and deployment pipelines.
4Measurement precision
If deobfuscation processing is performed to improve detection accuracy, then malicious code identification is improved, but processing time increases
Solution Approach 1:
The system performs partial deobfuscation, processing only the portions of JavaScript code that are most likely to contain malicious patterns. Rather than fully deobfuscating entire codebases, the system applies deobfuscation selectively to suspicious segments, maintaining high malicious code identification accuracy while minimizing processing time through targeted analysis.
Data Source
AI summary
Aspects of the present disclosure are operable to protect against malicious objects, such as JavaScript code, which may be encountered, downloaded, or otherwise accessed from a content source by a computing system. In an example, antivirus software implementing aspects disclosed herein may be capable of detecting malicious objects in real-time. Aspects of the present disclosure aim to reduce the amount of time used to detect malicious code while maintaining detection accuracy, as detection delays and/or a high false positive rate may result in a negative user experience. Among other benefits, the systems and methods disclosed herein are operable to identify malicious objects encountered by a computing system while maintaining a high detection rate, a low false positive rate, and a high scanning speed.