Tokenized Code Clustering for Malicious Script Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus systems face challenges in detecting and identifying malicious JavaScript code due to exploit kits' ability to evade detection by making trivial changes, leading to a constant arms race and limited effectiveness in identifying new versions.
Innovation Solution
An automated system that tokenizes JavaScript code samples based on syntactical elements, clusters similar samples, and generates generalized signatures to identify and label malicious code, using techniques like winnowing to compare with known malicious samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus systems use traditional signature-based detection methods, then they can identify known malicious code, but exploit kit providers can easily evade detection by making trivial changes to the code
Solution Approach 1:
The patent transforms the detection approach by changing parameters from exact byte-matching to similarity-based matching using winnowing algorithms. This allows the system to detect malicious code even when parameters like variable names, comments, or minor code structures are modified, thereby resolving the contradiction between detection accuracy and evolution resistance
Solution Approach 2:
The patent applies the concept of color changes by using different representation forms of the same code (e.g., tokenized versions, de-obfuscated versions) to detect the underlying malicious intent regardless of surface-level modifications. This enables detection of malicious code that has been visually or syntactically altered
2Measurement precision
If anti-virus vendors create new signatures for each exploit kit version, then detection accuracy improves, but the time required to update signatures increases significantly
Solution Approach 1:
The patent implements self-service by enabling automated signature generation through winnowing algorithms that can independently identify malicious patterns and create detection signatures without requiring manual analysis. This automation dramatically reduces the time from malicious code emergence to detection capability
Solution Approach 2:
The patent applies preliminary action by pre-computing winnowing signatures and storing them for rapid comparison. This preparation allows the system to quickly detect new malicious code variants without requiring time-consuming real-time analysis, thus reducing the response time to emerging threats
3Object-generated harmful factors
If exploit kit providers obfuscate and pack payload code, then they can evade detection, but the complexity of analyzing and creating effective signatures increases
Solution Approach 1:
The patent introduces an intermediary approach by using winnowing algorithms that work with tokenized representations of code rather than raw obfuscated code. This intermediary layer simplifies the analysis by focusing on structural patterns and semantic elements that remain consistent despite obfuscation, reducing the complexity of signature generation
Data Source
AI summary
Disclosed herein are systems and methods for detecting script code malware and generating signatures. A plurality of script code samples are received and transformed into a plurality of tokenized samples. The tokenized samples are based on syntactical elements of the plurality of script code samples. One or more clusters of samples are determined based on similarities in different ones of the plurality of tokenized samples, and known malicious code having a threshold similarity to a representative sample of the cluster of samples is identified. Based on the identifying, the cluster of samples is identified as malicious. Based at least on respective ones of the plurality of tokenized samples associated with the cluster of samples, a generalized code signature usable to identify the script code samples in the cluster of samples is generated.