Universal Script Emulation for Obfuscated Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anti-malware systems face challenges in efficiently detecting malware in obfuscated scripts due to the need for multiple language-specific emulators, leading to high memory usage and processing demands that deplete resources needed for user activities.
Innovation Solution
A system and method that utilizes a universal emulator to convert obfuscated scripts into modified abstract syntax trees (mAST) for analysis, enabling efficient malware detection without the need for language-specific emulators, thus reducing resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple language-specific emulators are used to detect malware in obfuscated scripts, then detection coverage is improved, but memory usage and processing demands increase significantly
Solution Approach 1:
The patent implements a universal emulator that can execute multiple scripting languages (PowerShell, VBScript, JavaScript, etc.) through a single unified interface. This universal emulator translates language-specific operations into a standardized internal representation, eliminating the need for multiple separate language-specific emulators and thereby reducing memory consumption while maintaining comprehensive malware detection coverage across different script types
Solution Approach 2:
The patent merges multiple language-specific analysis capabilities into a single integrated system. By combining the functionality of multiple language-specific emulators into one unified emulator that handles various scripting languages through a common architecture, the system reduces overall memory usage and processing overhead while maintaining the ability to detect malware across different language environments
2Reliability
If multiple language-specific emulators are used to detect malware in obfuscated scripts, then detection coverage is improved, but processing demands increase significantly
Solution Approach 1:
The universal emulator provides a single processing engine that handles multiple scripting languages by translating them into a unified internal representation. This eliminates the need for multiple separate processing chains that would each require full language-specific emulator overhead, thereby reducing total processing demands while maintaining comprehensive detection coverage for malware written in different scripting languages
Solution Approach 2:
The patent creates a standardized copy or representation of script operations that is language-agnostic. Instead of processing each language-specific script through its dedicated emulator with full language understanding overhead, the system translates all scripts into a common intermediate representation that can be processed uniformly, reducing processing demands while preserving the essential behavioral characteristics needed for malware detection
3Reliability
If conventional anti-malware systems use multiple language-specific emulators, then malware detection capability is improved, but resources available for user activities decrease
Solution Approach 1:
The universal emulator consolidates multiple language-specific emulation capabilities into a single resource-efficient engine. This allows the anti-malware system to maintain comprehensive detection capability across PowerShell, VBScript, JavaScript and other scripting languages while consuming fewer computational resources, thereby leaving more system resources available for user-facing applications and activities
4Reliability
If sandbox solutions are used to detect malware in obfuscated scripts, then detection accuracy is improved, but time requirements increase significantly
Solution Approach 1:
The patent replaces the traditional mechanical sandbox approach (which requires actual execution of scripts in isolated environments) with a static analysis system that uses modified abstract syntax trees and pattern matching. This substitution allows the system to achieve high detection accuracy by analyzing script structure and behavior patterns without the time overhead of actually executing potentially malicious code in sandboxed environments
Data Source
AI summary
A system receives a script on a computing device. The system receives initial artifacts by executing the script using an emulator, wherein the initial artifacts comprise the obfuscated script written in a first coding language incompatible with a malware scanner on the computing device. The system converts each line of the obfuscated script in the first coding language into a respective logical tree. The system receives artifacts of the obfuscated script by executing, using a universal emulator, at least one logical tree generated based on the obfuscated script. The system scans the artifacts for malware using the malware scanner. The system in response to detecting the malware in the obfuscated script based on scanning the artifacts, performs a remediation action on the obfuscated script.