Identification of normal scripts in computer systems

• US 8,838,992 B1
• Filed: 04/28/2011
• Issued: 09/16/2014
• Est. Priority Date: 04/28/2011
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Zhu, Xuewen, Diao, Lili, Tang, Dibin, Li, Da
• Primary Examiner(s): Troung, Thanhnga B
• Assistant Examiner(s): LANE, GREGORY A
• Application Number:
  US13/096,453
• Time in Patent Office: 1,237 Days
• Field of Search: 726/23, 726/24, 709/206
• US Class Current: 713/186
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links

Abstract

A machine learning model is used to identify normal scripts in a client computer. The machine learning model may be built by training using samples of known normal scripts and samples of known potentially malicious scripts and may take into account lexical and semantic characteristics of the sample scripts. The machine learning model and a feature set may be provided to the client computer by a server computer. In the client computer, the machine learning model may be used to classify a target script. The target script does not have to be evaluated for malicious content when classified as a normal script. Otherwise, when the target script is classified as a potentially malicious script, the target script may have to be further evaluated by an anti-malware or sent to a back-end system.

Claims

1. A computer-implemented method of identifying normal scripts, the method comprising:

receiving a machine learning model and a feature set in a client computer, the machine learning model being trained using sample scripts that are known to be normal and sample scripts that are known to be potentially malicious and takes into account lexical and semantic characteristics of the sample scripts that are known to be normal and the sample scripts that are known to be potentially malicious;

receiving a target script along with a web page in the client computer, the target script and the web page being received from a server computer over a computer network;

extracting from the target script features that are included in the feature set;

inputting the extracted features of the target script into the machine learning model to receive a classification of the target script from the machine learning model; and

detecting that the target script is a normal script and not a potentially malicious script based on the classification of the target script.

2. The method of claim 1 wherein the machine learning model comprises a support vector machine (SVM).

3. The method of claim 2 wherein inputting the extracted features of the target script into the machine learning model comprises:

forming a feature vector having features comprising the extracted features of the target script; and

using the feature vector as an input to the support vector machine.

4. The method of claim 1 further comprising:

in response to detecting that the target script is a normal script and not a potentially malicious script, allowing a web browser in the client computer to use the target script without having an anti-malware in the client computer first evaluate the target script.

5. The method of claim 4 wherein the machine learning model and the feature set were received by the client computer from another server computer over a computer network.

6. The method of claim 1 wherein the lexical characteristics of the sample scripts that are known to be potentially malicious and the sample scripts that are known to be normal include a count of white space in the sample scripts that are known to be potentially malicious and the sample scripts that are known to be normal.

7. The method of claim 1 wherein the target script comprises a JavaScript.

8. The method of claim 1 further comprising:

receiving another target script in the client computer;

detecting that the other target script is a potentially malicious script based on a classification of the other target script by the machine learning model; and

in response to detecting that the other target script is a potentially malicious script, initiating further examination of the other target script by an anti-malware running in the client computer.

9. A client computer comprising a processor configured to execute computer-readable program code stored non-transitory in a computer-readable medium, the computer-readable medium comprising:

a web browser;

an anti-malware;

a machine learning model; and

a normal script identifier configured to receive a first script in the client computer, to determine whether the first script is a normal script by having the first script classified by the machine learning model, to allow the first script to be used by the web browser without first having the first script evaluated by the anti-malware for malicious content in response to detecting that the first script is a normal script and not a potentially malicious script, to receive a second script in the client computer, to detect that the second script is a potentially malicious script based on a classification of the second script by the machine learning model, and to initiate further examination of the second script by the anti-malware in response to detecting that the second script is a potentially malicious script.

10. The client computer of claim 9 wherein the computer-readable medium further comprises a feature set comprising attributes indicative of a normal script.

11. The client computer of claim 10 wherein the normal script identifier is further configured to extract from the first script features that are noted in the feature set.

12. The client computer of claim 9 wherein the first script is embedded in a web page.

13. A computer-implemented method of identifying normal scripts, the method comprising:

using a machine learning model to determine a classification of a first script in a client computer;

detecting that the first script is a normal script based on the classification of the first script;

foregoing evaluation of the first script by an anti-malware in response to detecting that the first script is a normal script;

receiving a second script in the client computer;

detecting that the second script is a potentially malicious script based on a classification of the second script by the machine learning model; and

in response to detecting that the second script is a potentially malicious script, initiating further examination of the second script by the anti-malware.

14. The method of claim 13 wherein the machine learning model comprises a support vector machine (SVM).

15. The method of claim 14 wherein using the learning model to determine the classification of the first script comprises:

extracting from the first script features that are included in a feature set;

forming a feature vector having features comprising the extracted features of the first script; and

inputting the feature vector into the machine learning model to receive the classification of the first script from the machine learning model.

16. The method of claim 15 wherein the machine learning model and the feature set were received by the client computer from a server computer over a computer network.

17. The method of claim 13 wherein the first script comprises JavaScript.

18. The method of claim 13 wherein the first script was received by the client computer from a server computer hosting a website and providing a web page to the client computer.

19. The method of claim 18 were in the first script is embedded in the web page.