METHOD AND SYSTEM FOR DETECTING MALICIOUS SCRIPT

• US 20120159629A1
• Filed: 06/21/2011
• Published: 06/21/2012
• Est. Priority Date: 12/16/2010
• Status: Abandoned Application

• Current Assignee: National Taiwan University of Science and Technology
• Original Assignee: National Taiwan University of Science and Technology
• Inventors: Lee, Hahn-Ming, Yeh, Jerome, Mao, Ching-Hao, Chen, Hung-Chang
• Application Number:
  US13/165,787
• Publication Number:
  US 20120159629A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method for detecting a malicious script is provided. A plurality of distribution eigenvalues are generated according to a plurality of function names of a web script. After the distribution eigenvalues are inputted to a hidden markov model (HMM), probabilities respectively corresponding to a normal state and an abnormal state are calculated. Accordingly, whether the web script is malicious or not can be determined according to the probabilities. Even an attacker attempts to change the event order, insert a new event or replace an event with a new one to avoid detection, the method can still recognize the intent hidden in the web script by using the HMM for event modeling. As such, the method may be applied in detection of obfuscated malicious scripts.

Claims

1. A method for detecting a malicious script, comprising:

receiving a web script;

extracting a plurality of function names of the web script;

generating a plurality of distribution eigenvalues according to the function names;

inputting the distribution eigenvalues into a hidden markov model which defines a normal state and an abnormal state;

using the hidden markov model to calculate a first probability and a second probability according to the distribution eigenvalues, the first probability and the second probability corresponding to the normal state and the abnormal state, respectively; and

determining whether the web script is malicious according to the first probability and the second probability.

2. The method for detecting a malicious script according to claim 1, wherein, after determining whether the web script is malicious, the method further comprises issuing and storing a warning message.

3. The method for detecting a malicious script according to claim 1, wherein, before receiving the web script, the method further comprises:

receiving a plurality of training scripts;

extracting a plurality of training function names of the training scripts;

calculating a plurality of training distribution eigenvalues according to the training function names;

determining a plurality of transition probability parameters and a plurality of emission probability parameters of the hidden markov model according to the training distribution eigenvalues; and

establishing the hidden markov model according to the transition probability parameters and the emission probability parameters.

4. The method for detecting a malicious script according to claim 3, wherein determining the transition probability parameters and the emission probability parameters comprises using a counting rule and conditional probability to calculate the transition probability parameters and the emission probability parameters.

5. The method for detecting a malicious script according to claim 1, wherein calculating the first probability and the second probability comprises using a forward algorithm to sum up the probabilities of the distribution eigenvalues corresponding to the normal state and the abnormal state.

6. A system for detecting a malicious script, comprising:

a web script collector for receiving a web script;

a script function extractor for extracting a plurality of function names of the web script and generating a plurality of distribution eigenvalues according to the function names; and

an abnormal state detector adapted to input the distribution eigenvalues into a hidden markov model so as to use the hidden markov model to calculate a first probability and a second probability according to the distribution eigenvalues to thereby determine whether the web script is malicious, wherein the hidden markov model defines a normal state and an abnormal state, and the first probability and the second probability correspond to the normal state and the abnormal state, respectively.

7. The system for detecting a malicious script according to claim 6, wherein the abnormal state detector is adapted to further issue a warning message, and the malicious script detecting system further includes a warning message database storing the warning message.

8. The system for detecting a malicious script according to claim 6, wherein the web script collector further receives a plurality of training scripts, and the script function extractor extracts a plurality of training function names of the training scripts and calculates a plurality of training distribution eigenvalues, and the malicious script detecting system further comprises:

a model parameter estimator for determining a plurality of transition probability parameters and a plurality of emission probability parameters of the hidden markov model according to the training distribution eigenvalues; and

a model generator for establishing the hidden markov model according to the transition probability parameters and the emission probability parameters.

9. The system for detecting a malicious script according to claim 8, wherein the model parameter estimator uses a counting rule and conditional probability to calculate the transition probability parameters and the emission probability parameters.

10. The system for detecting a malicious script according to claim 6, wherein the abnormal state detector uses a forward algorithm to sum up the probabilities of the distribution eigenvalues corresponding to the normal state and the abnormal state to calculate the first probability and the second probability.