Web Skimmer Detection Using Encoded Rules and Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions struggle to effectively detect obfuscated web skimmers due to their use of obfuscation techniques, rendering static signatures and URL filtering ineffective, and machine learning-based approaches inefficient for new variants.
Innovation Solution
A system and method for detecting obfuscated web skimmers using a combination of static analysis with encoded detection rules and dynamic analysis through hooking, which involves encoding known skimmer patterns and monitoring malicious behaviors to extract deobfuscated content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static signatures and URL filtering are used to detect web skimmers, then detection speed is fast, but detection effectiveness deteriorates due to obfuscation
Solution Approach 1:
The patent introduces an intermediary deobfuscation module that acts as a mediator between the obfuscated web skimmer code and the detection system. This module translates obfuscated JavaScript code into readable format, enabling static signatures to effectively match malicious patterns despite obfuscation techniques, thus resolving the contradiction between detection effectiveness and system complexity
Solution Approach 2:
The system performs preliminary deobfuscation action before detection occurs. By pre-processing the obfuscated code to remove encryption and obfuscation layers, the system prepares clean, readable code for subsequent signature matching, thereby maintaining high detection effectiveness without requiring complex real-time analysis
2Adaptability or versatility
If machine learning-based detection approaches are used, then adaptability to new variants improves, but processing efficiency deteriorates
Solution Approach 1:
The detection system is segmented into distinct functional modules: a deobfuscation module that handles code translation, a static analysis module that uses predefined signatures for fast matching, and a dynamic analysis module that provides adaptability. This segmentation allows the system to maintain high processing efficiency through fast signature matching while achieving adaptability through targeted dynamic analysis only when needed
Solution Approach 2:
The system applies partial dynamic analysis only to suspicious code samples that trigger static detection rules, rather than analyzing all code dynamically. This selective approach maintains processing efficiency by avoiding unnecessary dynamic analysis while preserving adaptability to new variants through the static signature system that covers known attack patterns
3Measurement precision
If deobfuscation is performed to detect web skimmers, then detection accuracy improves, but processing time increases
Solution Approach 1:
The deobfuscation process is performed as a preliminary action before detection occurs. By pre-translating obfuscated code into readable format, the system enables accurate signature matching without requiring time-consuming real-time deobfuscation during the detection phase, thus improving detection accuracy while minimizing processing time overhead
Data Source
AI summary
Various techniques for detecting obfuscated web skimmers based on encoding and hooking are disclosed. In some embodiments, a system/process/computer program product for detecting obfuscated web skimmers based on encoding and hooking includes receiving a sample; performing static analysis on the sample using encoded web skimmer detection rules (e.g., encoded using a plurality of encoding methods); performing dynamic analysis on the sample using hooking; and detecting an obfuscated web skimmer based on results of the static analysis using the encoded web skimmer detection rules and/or the dynamic analysis using hooking.