METHOD AND SYSTEM FOR DETECTING EXECUTION OF A MALICIOUS CODE IN A WEB BASED OPERATING SYSTEM

• US 20160127412A1
• Filed: 11/05/2014
• Published: 05/05/2016
• Est. Priority Date: 11/05/2014
• Status: Abandoned Application

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: BESKROVNY, Evgeny, HOCH, Yaacov
• Application Number:
  US14/533,194
• Publication Number:
  US 20160127412A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A method for detecting a malicious code injected into the command stream of a widget running by a web-based OS at a device. The method is multi-stepped. Introducing by an App-Store hooks to within the command stream of the widget. Running at the App-Store the widget on an App-Store device, measuring respective time durations between various hooks, and recording said time durations within a metadata file. Associating said metadata file with said widget, and supplying said widget, and associated metadata file to within a user device. Upon running said widget by a web based OS at said user device, activating a monitoring module, determining durations between said introduced hooks, and comparing respectively said determined time durations with said measured time durations. And issuing an alert upon detection of a variation above a predefined value between any of said determined durations and said measured durations respectively.

Claims

1. A method for detecting a malicious code which is injected into the command stream of a widget running by a web-based OS at a device, which comprises:

a) introducing by an App-Store hooks to within the command stream of the widget;

b) running at the App-Store the widget on an App-Store device, measuring respective time durations between various hooks, and recording said time durations within a metadata file;

c) associating said metadata file with said widget, and supplying said widget, including said associated metadata file to within a user device which is substantially identical to said App-Store device;

d) upon running said widget by a web based OS at said user device, activating a monitoring module, determining by said module times durations between said introduced hooks, and comparing respectively said determined time durations with said measured time durations; and

e) issuing an alert upon detection of a variation above a predefined value between any of said determined durations and said measured durations respectively.

2. The method according to claim 1, wherein said monitoring module is a part of said web-based OS.

3. The method according to claim 1, wherein when an update is introduced at the APP-Store to said widget, a corresponding updated metadata file is also prepared, and sent to the device together with said update to the widget.

4. The method according to claim 1, wherein when an update is introduced at the APP-Store into said web based OS that affect any of said measured time durations, said metadata file is also updated respectively, and said updated metadata file is sent to the device together with said updated web based OS.

5. The method according to claim 1, wherein said variation is a time value.

6. The method according to claim 1, wherein said variation is a percentage value.

7. The method according to claim 1, which is performed separately for each device model.

8. The method according to claim 1, wherein all updates to said widget, said metadata file, and said web based OS are performed by the App-Store.

9. System according to claim 1, wherein the hooks are introduced every X lines of the widget code, where X is a constant integer.

10. System according to claim 1, wherein the hooks are introduced only in functions that do not involve with inputting from a user.

11. System according to claim 1, wherein the hooks are introduced randomly within the widget lines of code.