Analysis of scripts

• US 9,319,428 B2
• Filed: 06/20/2012
• Issued: 04/19/2016
• Est. Priority Date: 10/02/2009
• Status: Expired due to Fees

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Freeman, Robert George
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US13/527,644
• Publication Number:
  US 20120260338A1
• Time in Patent Office: 1,399 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25, 713/188, 380/37
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method and system for analyzing scripts. A script is analyzed to determine whether the script includes malicious content. A computer executes at least two text blocks of code derived from a script of a web page. The execution of a text block of the at least two text blocks generates an additional text block of code. The computer determines whether the additional text block includes new code that is malicious. If so, the computer prevents transmission of the web page to a client computer. If not, the computer transmits the web page to the client computer.

Claims

1. A method for determining whether a script from a web page includes malicious content, the method comprising:

a first computer executing a plurality of text blocks of code derived from the script from the web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code;

the first computer copying each text block to an output file in a data storage area of the first computer, wherein the first text block is copied before another text block of the plurality of text blocks is copied; and

after said copying each text block to the output file, the first computer determining that the new text block includes malicious code and in response, the first computer preventing transmission of the web page to the client computer.

2. The method of claim 1, the method comprising:

before the determining that the new text block includes malicious code, the first computer executing the new text block and copying to the output file in the data storage area the new text block.

3. The method of claim 2, the determining comprising:

analyzing the new text block on the output file and at least one text block of the plurality of text blocks on the output file to ascertain that the new text block comprises text that (i) is not directly inferred from text appearing in the script and (ii) includes the malicious code.

4. The method of claim 3, wherein the at least one text block comprises text that is directly inferred from text appearing in the script.

5. The method of claim 1, wherein the first computer determines that the new text block includes malicious code by determining that the new text block includes programming to download an executable file from a location outside the first computer and initiate execution of the executable file.

6. The method of claim 1, wherein the script is a text block of the plurality of text blocks that is executed before any other text box of the plurality of text boxes is executed.

7. The method of claim 1, the method comprising:

the first computer determining a web page transmission indicator whose value indicates whether the web page will be transmitted to the client computer.

8. A computer program product for determining whether a script from a web page includes malicious content, the computer program product comprising:

one or more computer readable storage devices and program instructions stored on the one or more storage devices, wherein the program instructions comprise;

program instructions to execute, by a first computer, a plurality of text blocks of code derived from the script from the web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code;

program instructions to co each text block to an output file in a data storage area of the first computer, wherein the first text block is copied before another text block of the plurality of text blocks is copied; and

program instructions to determine, after each text block has been copied to the output file, that the new text block includes malicious code and in response, to prevent transmission, by the first computer, of the web page to the client computer.

9. The computer program product of claim 8, the computer program product comprising:

program instructions, stored on the one or more storage devices, to, before it is determined that the new text block includes the new code that is malicious, execute the new text block and copy to the output file in the data storage area the new text block.

10. The computer program product of claim 9, wherein the program instructions to determine that the new text block includes malicious code comprises:

program instructions to analyze the new text block on the output file and at least one text block of the plurality of text blocks on the output file to ascertain that the new text block comprises text that (i) is not directly inferred from text appearing in the script and (ii) includes the malicious code.

11. The computer program product of claim 10, wherein the at least one text block comprises text that is directly inferred from text appearing in the script.

12. The computer program product of claim 8, wherein the program instructions to determine that the new text block includes malicious code comprises program instructions to determine that the new text block includes programming to download an executable file from a location outside the first computer and initiate execution of the executable file.

13. The computer program product of claim 8, wherein the script is a text block of the plurality of text blocks that is executed before any other text box of the plurality of text boxes is executed.

14. The computer program product of claim 8, the computer program product comprising:

program instructions, stored on the one or more storage devices, to determine a web page transmission indicator whose value indicates whether the web page will be transmitted to the client computer.

15. A computer system for analyzing a script to determine whether the script includes malicious content, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable storage devices, and program instructions stored on the one or more storage devices for execution by the one or more processors via the one or more memories, wherein the program instructions comprise;

program instructions to execute, by a first computer, a plurality of text blocks of code derived from the script from the web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code;

program instructions to co each text block to an output file in a data storage area of the first computer, wherein the first text block is copied before another text block of the plurality of text blocks is copied; and

program instructions to determine, after each text block has been copied to the output file, that the new text block includes malicious code and in response, to prevent transmission, by the first computer, of the web page to the client computer.

16. The computer system of claim 15, the computer system comprising:

program instructions, stored on the one or more storage devices, to, before it is determined that the new text block includes the new code that is malicious, execute the new text block and copy to the output file in the data storage area the new text block.

17. The computer system of claim 16, wherein the program instructions to determine that the new text block includes malicious code comprises:

program instructions to analyze the new text block on the output file and at least one text block of the plurality of text blocks on the output file to ascertain that the new text block comprises text that (i) is not directly inferred from text appearing in the script and (ii) includes the malicious code.

18. The computer system of claim 17, wherein the at least one text block comprises text that is directly inferred from text appearing in the script.

19. The computer system of claim 15, wherein the program instructions to determine that the new text block includes malicious code comprises program instructions to determine that the new text block includes programming to download an executable file from a location outside the first computer and initiate execution of the executable file.

20. The computer system of claim 15, wherein the script is a text block of the plurality of text blocks that is executed before any other text box of the plurality of text boxes is executed.