Malicious Script Detection via Unique Script Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional antivirus scanners face challenges in efficiently scanning for malicious scripts, especially encrypted ones on web pages, due to high CPU and memory resource demands and the need for large pattern files that consume memory and processing resources.
Innovation Solution
A local engine at a client computer intercepts URL access to identify unique scripts, which are then sent to a script analyzer for emulation to detect malicious code, reducing resource consumption by focusing on specific scripts rather than entire files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional antivirus scanners use pattern matching with large pattern files to detect malicious codes, then detection coverage is improved, but memory and processing resources are consumed
Solution Approach 1:
The patent segments the detection task by dividing web content into individual scripts and further identifying only unique scripts for analysis. Instead of scanning entire web pages or using comprehensive pattern files, the system extracts and analyzes only the unique script components that may contain malicious code, significantly reducing the detection workload while maintaining effectiveness
Solution Approach 2:
The system extracts only the unique scripts from web pages for analysis, separating them from the rest of the web content. This extraction approach allows the system to focus computational resources only on the relevant portions (unique scripts) rather than processing entire web pages or maintaining large pattern files, thereby reducing memory and processing resource consumption
2Reliability
If emulator with heuristic rules is used at client computer to detect encrypted scripts, then detection capability is improved, but CPU and memory resources are consumed
Solution Approach 1:
The patent introduces a server-based script analysis system that acts as an intermediary between the client and the emulation process. The client sends unique scripts to the server, which then performs the resource-intensive emulation and heuristic analysis. This mediator approach allows the client to maintain detection capability while offloading the heavy computational burden to the server, thus reducing local CPU and memory resource consumption
3Reliability
If entire web pages are scanned for malicious codes, then comprehensive detection is achieved, but processing time and resources increase
Solution Approach 1:
The system segments web pages into individual script components and further identifies only the unique scripts within those components. This segmentation allows the system to skip over repetitive or known-safe content and focus only on the unique scripts that require analysis, dramatically reducing processing time while maintaining comprehensive detection of potential threats
Solution Approach 2:
Instead of performing full emulation and analysis on all scripts in web pages, the system applies partial action by analyzing only the unique scripts. This selective approach performs sufficient analysis on the critical portions (unique scripts) while avoiding redundant processing of non-unique or already-known scripts, thereby reducing processing time without sacrificing detection effectiveness
Data Source
AI summary
One embodiment relates to a computer-implemented method for detecting malicious scripts in web pages. A local engine and an application are executed at a client computer. The local engine intercepts an access by the application to a web page at a universal resource locator (URL) under a domain. The local engine determines scripts at the URL and scripts at other URLs under the domain. Using that information, the local engine determines if the scripts at the URL include one or more unique script(s). The local engine sends the unique script(s), if any, via a network to a script analyzer. The script analyzer may then perform emulation of the unique script(s) to detect malicious code therein. Other embodiments, aspects and features are also disclosed.