Normalizing and detecting inserted malicious code

Patent metadata

Field	Value
Publication number	US-9727728-B2
Application number	US-201414568193-A
Country	US
Kind code	B2
Filing date	Dec 12, 2014
Priority date	Dec 12, 2014
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

A method, system, and computer program product for detecting malicious code insertion in data are provided in the illustrative embodiments. At an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content is detected. A content-related portion is removed from the script to form a remaining script structure, the content-related portion referring to the content in the mix. From the remaining script structure, a code construct is selected and replaced with an alphanumeric string to form a normalized construct. Whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts is determined. Responsive to the normalized construct matching the second normalized construct within the tolerance, a conclusion is drawn that the script is malicious.

First claim

What is claimed is:

1. A computer usable program product comprising a computer readable storage device including computer usable code for detecting malicious code insertion in data, the computer usable code comprising:
computer usable code for detecting, at an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content;
computer usable code for removing, to form a remaining script structure, from the script a content-related portion, the content-related portion referring to the content in the mix;
computer usable code for selecting, from the remaining script structure, a code construct, wherein the code construct comprises a function call, and wherein the function call comprises any call to any function in the remaining script structure;
computer usable code for replacing, to form a normalized construct, the code construct with an alphanumeric string;
computer usable code for determining whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts; and
computer usable code for concluding, responsive to the normalized construct matching the second normalized construct within the tolerance, that the script is malicious.

2. The computer usable program product of claim 1 , further comprising:
computer usable code for determining whether the script is obfuscated;
computer usable code for executing, responsive to the script being obfuscated, the script to obtain an actual script; and
computer usable code for replacing the script with the actual script.

3. The computer usable program product of claim 1 , further comprising:
computer usable code for identifying a behavior of the remaining script structure, wherein the behavior comprises an operation performed by the code construct one of (i) occurs at a particular time, (ii) occurs at a particular location in the data processing system, (iii) causes an event in the data processing system, and (iv) prevents another operation in the data processing system;
computer usable code for determining whether the behavior matches within a second tolerance, a known behavior of a malicious code; and
computer usable code for affirming, responsive to the behavior matching the known behavior of the malicious code within the second tolerance, the concluding that the script is malicious.

4. The computer usable program product of claim 1 , further comprising:
computer usable code for identifying a behavior of the remaining script structure, wherein the behavior comprises an operation performed by the code construct one of (i) occurs at a particular time, (ii) occurs at a particular location in the data processing system, (iii) causes an event in the data processing system, and (iv) prevents another operation in the data processing system;
computer usable code for performing a statistical analysis on the behavior to determine whether the behavior is statistically suspicious relative to the mix; and
computer usable code for affirming, responsive to the behavior being statistically suspicious, the concluding that the script is malicious.

5. The computer usable program product of claim 1 , further comprising:
computer usable code for generating classification metadata for the script, where the classification metadata comprises a combination of (i) the normalized construct and (ii) a behavior of the remaining script structure; and
computer usable code for adding in the classification metadata a classification code according to a classification specification, wherein the classification code corresponds to a type of malicious nature of the script.

6. The computer usable program product of claim 1 , wherein the computer usable code is stored in a computer readable storage device in a data processing system, and wherein the computer usable code is transferred over a network from a remote data processing system.

7. The computer usable program product of claim 1 , wherein the computer usable code is stored in a computer readable storage device in a server data processing system, and wherein the computer usable code is downloaded over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system.

8. A data processing system for detecting malicious code insertion in data, the data processing system comprising:
a storage device, wherein the storage device stores computer usable program code; and

a processor, wherein the processor executes the computer usable program code, and wherein the computer usable program code comprises:
computer usable code for detecting, at an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content;
computer usable code for removing, to form a remaining script structure, from the script a content-related portion, the content-related portion referring to the content in the mix;
computer usable code for selecting, from the remaining script structure, a code construct, wherein the code construct comprises a function call, and wherein the function call comprises any call to any function in the remaining script structure;
computer usable code for replacing, to form a normalized construct, the code construct with an alphanumeric string;
computer usable code for determining whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts; and
computer usable code for concluding, responsive to the normalized construct matching the second normalized construct within the tolerance, that the script is malicious.

Assignees

• IBM

Inventors

• Avrahami Ela
• Eli Ziv
• Moore Daniel

Classifications

• G06F21/564

  by virus signature recognition · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/563 Primary

  by source code analysis · CPC title