Analysis of scripts

• US 9,971,893 B2
• Filed: 03/02/2016
• Issued: 05/15/2018
• Est. Priority Date: 10/02/2009
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Freeman, Robert G.
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US15/058,796
• Publication Number:
  US 20160180091A1
• Time in Patent Office: 804 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method and associated system. A first computer executes at least two text blocks of code derived from a script of a web page in response to a request for the web page from a client computer. The text blocks are executed sequentially in a sequential order. The script is a first text block of the at least two text blocks. The execution of one text block of the at least two text blocks by the first computer generates a new text block of code.

Claims

1. A method, said method comprising:

a first computer executing a plurality of text blocks of code derived from a script from a web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code; and

said first computer determining that the new text block includes malicious code and in response, said first computer preventing transmission of the web page to the client computer.

2. The method of claim 1, said method comprising:

said first computer copying each text block to an output file in a data storage area of the first computer, wherein the first text block is copied before another text block of the plurality of text blocks is copied.

3. The method of claim 1, said method comprising:

before said determining that the new text block includes malicious code, said first computer executing the new text block and copying the new text block to an output file in a data storage area.

4. The method of claim 3, wherein said determining that the new text block includes malicious code comprises:

analyzing the new text block on the output file and at least one text block of the plurality of text blocks to ascertain that the new text block comprises text that (i) is not directly inferred from text appearing in the script and (ii) includes the malicious code.

5. The method of claim 4, wherein the at least one text block comprises text that is directly inferred from text appearing in the script.

6. The method of claim 3, wherein said determining that the new text block includes malicious code comprises:

determining that the new text block includes programming to download an executable file from a location outside the first computer and initiate execution of the executable file.

7. The method of claim 1, wherein the script is a text block of the plurality of text blocks that is executed before any other text box of the plurality of text boxes is executed.

8. The method of claim 1, said method comprising:

said first computer determining a web page transmission indicator whose value indicates whether the web page will be transmitted to the client computer.

9. A computer program product, comprising one or more computer readable hardware storage devices having computer readable program code stored therein, said program code containing instructions executable by one or more processors of a computer system to implement a method, said method comprising:

a first computer executing a plurality of text blocks of code derived from a script from a web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code; and

said first computer determining that the new text block includes malicious code and in response, said first computer preventing transmission of the web page to the client computer.

10. The computer program product of claim 9, said method comprising:

said first computer copying each text block to an output file in a data storage area of the first computer, wherein thy;

first text block is copied before another text block of the plurality of text blocks is copied.

11. The computer program product of claim 9, said method comprising:

before said determining that the new text block includes malicious code, said first computer executing the new text block and copying the new text block to an output file in a data storage area.

12. The computer program product of claim 11, wherein said determining that the new text block includes malicious code comprises:

analyzing the new text block on the output file and at least one text block of the plurality of text blocks to ascertain that the new text block comprises text that (i) is clot directly inferred from text appearing in the script and (ii) includes the malicious code.

13. The computer program product of claim 12, wherein the at least one text block comprises text that is directly inferred from text appearing in the script.

14. A computer system, comprising one or more processors, one or more memories, and one or more computer readable hardware storage devices, said one or more hardware storage device containing program code executable by the one or more processors via the one or more memories to implement a method, said method comprising:

a first computer executing a plurality of text blocks of code derived from a script from a web page in response to a request for the web page from a client computer, said text blocks executed sequentially in a sequential order, wherein the script is a first text block of the plurality of text blocks, the execution of one text block of the plurality of text blocks by the first computer generating a new text block of code; and

said first computer determining that the new text block includes malicious code and in response, said first computer preventing transmission of the web page to the client computer.

15. The computer system of claim 14, said method comprising:

said first computer copying each text block to an output file in a data storage area of the first computer, wherein the first text block is copied before another text block of the plurality of text blocks is copied.

16. The computer system of claim 14, said method comprising:

before said determining that the new text block includes malicious code, said first computer executing the new text block and copying the new text block to an output file in a data storage area.

17. The computer system of claim 16, wherein said determining that the new block includes malicious code comprises:

analyzing the new text block on the output fife and at least one text block of the plurality of text blocks to ascertain that the new text block comprises text that (i) is not directly inferred from text appearing in the script and (ii) includes the malicious code.