Apparatus, system and method for detecting and preventing malicious scripts using code pattern-based static analysis and api flow-based dynamic analysis

Patent metadata

Field	Value
Publication number	US-2016359875-A1
Application number	US-201514913900-A
Country	US
Kind code	A1
Filing date	Jan 23, 2015
Priority date	Dec 3, 2014
Publication date	Dec 8, 2016
Grant date	—

Abstract

Provided are an apparatus, a system and a method for detecting and preventing malicious scripts. The apparatus for detecting and preventing malicious scripts includes a signature management unit managing a first signature including code pattern information of previously-detected malicious scripts, a script analysis unit receiving the first signature from the signature management unit and analyzing a first script, which is included in a web page, using the first signature, and a script processing unit receiving analysis result data from the script analysis unit and processing the first script according to the analysis result data.

First claim

What is claimed is:

1 . An apparatus for detecting and preventing malicious scripts, comprising:
a signature management unit managing a first signature including code pattern information of previously-detected malicious scripts; a script analysis unit receiving the first signature from the signature management unit and analyzing a first script, which is included in a web page, using the first signature; and a script processing unit receiving analysis result data from the script analysis unit and processing the first script according to the analysis result data.

2 . The apparatus of claim 1 , wherein the script analysis unit includes a static analysis unit and a dynamic analysis unit, the static analysis unit analyzes a code pattern of the first script using the first signature and provides a second script, which is part of the first script not matching the first signature, to the dynamic analysis unit, and the dynamic analysis unit generates a first call trace including Application Programming Interface (API) flow information for the second script, receives a second signature including a second call trace of the previously-detected malicious scripts, and analyzes the first call trace using the second signature.

3 . The apparatus of claim 2 , wherein the static analysis unit includes a pattern inspection module and the pattern inspection module analyzes the code pattern of the first script using the first signature and generates first analysis result data including detection information and detection time information regarding the first script.

4 . The apparatus of claim 3 , wherein the static analysis unit further includes a code analysis module and the code analysis module generates first detection result data regarding any Hyper-Text Mark-up Language (HTML) 5 tag detected from the first script, second detection result data any JavaScript API flow detected from the first script, and third detection result data regarding a degree of obfuscation of the first script.

5 . The apparatus of claim 4 , wherein the static analysis unit further includes a cumulative value comparison module and the cumulative value comparison module generates a cumulative value by applying a predetermined weight to each of the first detection result data, the second detection result data and the third detection result data, and generates second analysis result data by determining whether the cumulative value is greater than a predefined threshold value.

6 . The apparatus of claim 2 , wherein the dynamic analysis unit includes a call trace generation module and the call trace generation module generates an API trace for the second script and generates the first call trace by Extensible Mark-up Language (XML)-converting the generated API trace.

7 . The apparatus of claim 6 , wherein the dynamic analysis unit further includes a call trace comparison module and the call trace comparison module extracts a sub-tree code from the first call trace, analyzes the extracted sub-tree code using the second signature, and generates third analysis result data including detection information and detection time information regarding the first call trace.

8 . The apparatus of claim 1 , wherein the script processing unit includes an analysis result processing module and a malicious code removal module, the analysis result processing module generates an event message according to the analysis result data and provides the event message to the signature management unit, and the malicious code removal module removes a malicious script from the first script.

9 . The apparatus of claim 8 , wherein the analysis result processing module sends a request for dynamic analysis to the script analysis unit according to the analysis result data.

10 . The apparatus of claim 8 , wherein the malicious code removal module removes a malicious JavaScript script included in the first script and blocks a malicious HTML code included in the first script.

11 . The apparatus of claim 1 , wherein the signature management unit includes an API access module, a signature receiving module and a signature storage module, the API access module sends a request for authentication information, which is used to call an API, to the signature receiving module, the signature receiving module receives signature update information from the signature storage unit according to the request for the authentication information, and the signature storage module stores the signature update information and signature search information therein.

12 . A system for detecting and preventing malicious scripts, comprising:
an apparatus for detecting and preventing malicious scripts, analyzing a first script, which is included in a web page, using a first signature or a second signature to determine whether a malicious script exists in the first script, and processing the first script according to analysis result data obtained by the analysis; and a signature management apparatus generating and managing the first signature or the second signature and providing the first signature or the second signature to the apparatus for detecting and preventing malicious scripts upon request, wherein the first signature includes code pattern information of previously-detected malicious scripts, the second signature includes a call trace, which has API flow information of the previously-detected malicious scripts, and the apparatus for detecting and preventing malicious scripts primarily performs static analysis on the first script using the first signature and secondarily performs dynamic analysis on the first script using the second signature.

13 . The system of claim 12 , wherein the apparatus for detecting and preventing malicious scripts includes a signature management unit, a script analysis unit and a script processing unit, the signature management unit manages the first signature or the second signature, the script analysis unit includes a static analysis unit and a dynamic analysis unit, the static analysis unit performs the static analysis using the first signature, the dynamic analysis unit performs the dynamic analysis using the second signature, and the script processing unit receives the analysis result data from the script analysis unit and processes the first script according to the analysis result data.

14 . The system of claim 13 , wherein the static analysis unit includes a pattern inspection module and a code analysis module, the pattern inspection module analyzes a code pattern of the first script using the first signature, provides a second script, which is part of the first script not matching the first signature, to the dynamic analysis unit, and generates first analysis result data including detection information and detection time information regarding the first script, and the code analysis module generates first detection result data regarding any HTML 5 tag detected from the first script, second detection result data regarding any JavaScript API flow detected from the first script, and third detection result data regarding a degree of obfuscation of the first script.

15 . The system of claim 14 , wherein the static analysis unit further includes a cumulative value comparison module generates a cumulative value by applying a predetermined weight to each of the first detection result data, the second detection result data and the third detection result data, and generates second analysis result data by determining whether the cumulative value is greater than a predefined threshold value.

16 . The system of claim 14 , wherein the dynamic analysis unit includes a call trac

Assignees

• Korea Internet & Security Agency

Inventors

• Kim Hwan Kuk
• Jung Jong Hun
• Bae Han Chul
• Choo Hyun Rok
• Jang Woung
• Oh Sang Hwan
• Yoon Soo Jin

Classifications

• G06F21/564

  by virus signature recognition · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L43/00

  Arrangements for monitoring or testing data switching networks · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title