Malicious script detection using context-dependent script emulation

• US 9,444,831 B1
• Filed: 10/22/2015
• Issued: 09/13/2016
• Est. Priority Date: 06/07/2010
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Lee, Charlie, Wan, Xiaochuan, Zhu, Xuewen, Ye, Hua
• Primary Examiner(s): SHAW, PETER C
• Application Number:
  US14/920,203
• Time in Patent Office: 327 Days
• Field of Search: 726/23
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

One embodiment relates to a computer-implemented process for detecting malicious scripts at a client computer using a malicious script detector. A web page interceptor intercepts an access of web page data at a universal resource locator address. A script preprocessor determines script fragments embedded in the web page data and extracts variable and function names from the script fragments. A context analyzer determines whether the script fragments reference known-good scripts. The context analyzer may check variable and function names in the script fragment against a database of known-good contexts. Those script fragments which were determined to reference known-good scripts may be categorized as non-malicious. An emulator may perform emulation on remaining script fragments which were not determined to reference known-good scripts and not perform emulation on the script fragments which were determined to reference known-good scripts. Other embodiments, aspects and features are also disclosed.

Claims

1. A computer-implemented process for detecting malicious scripts at a client computer, the process comprising:

requesting and receiving by the client computer a web page comprising script fragments from a web server;

intercepting the web page before any script fragment in the web page is executed by the client computer;

checking variables and function names present in the script fragments against a local database of known-good contexts including uniform resource locators (URLs) of legitimate third-party javascript libraries and URLs of site-specific javascript libraries, wherein the local database is updated periodically by downloading from a remote database residing on a dedicated security server, and wherein the security server obtains the third-party javascript libraries from a global framework whitelist and performs site framework discovery to obtain the site-specific javascript libraries;

classifying a script fragment in the script fragments as a known-good good script fragment and non-malicious, and then discarding the script fragment from the script fragments if a known-good context is present in the script fragment; and

performing emulation only on remaining script fragments to determine if the remaining script fragments are malicious or non-malicious.

2. The computer-implemented process of claim 1, further comprising:

blocking a malicious script fragment in the remaining script fragments from being executed.

3. A non-transitory computer-readable medium comprising instructions stored thereon, that when executed by a processor of a computer cause the computer to perform the steps of:

requesting and receiving by, the computer a web page comprising script fragments from a web server;

intercepting the web page before any script fragment in the web page is executed by the processor of the computer;

checking variables and function names present in the script fragments against a local database of known-good contexts including uniform resource locators (URLs) of legitimate third-party javascript libraries and URLs of site-specific javascript libraries, wherein the local database is updated periodically by downloading from a remote database residing on a dedicated security server, and wherein the security server obtains the third-party javascript libraries from a global framework whitelist and performs site framework discovery to obtain the site-specific javascript libraries;

classifying a script fragment in the script fragments as a known-good script fragment and non-malicious, and then discarding the script fragment from the script fragments if a known-good context is present in the script fragment; and

performing emulation only on remaining script fragments to determine if the remaining script fragments are malicious or non-malicious.

4. The non-transitory computer-readable medium of claim 3, wherein the instructions when executed by the processor further cause the computer to perform the step of blocking a malicious script fragment in the remaining script fragments from being executed.