Systems and methods for removing malicious code from a script without compromising script functionality
Disclosed herein are systems and method for removing malicious code from a script without compromising script functionality. In one aspect, the method includes: identifying, in a script, at least one string corresponding to a malicious pattern; generating an abstract syntax tree (AST) of the script; identifying, in the AST, a parent operator associated with the at least one string; determining an absolute position and length of a node representing the parent operator in the AST; and removing malicious code from the script based on the absolute position and length of the node.
1 . A method for removing malicious code from a script without compromising script functionality, the method comprising:
identifying, in a script, at least one string corresponding to a malicious pattern;
generating an abstract syntax tree (AST) of the script;
identifying, in the AST, a parent operator associated with the at least one string;
determining an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
removing malicious code from the script without generating syntax errors, including: generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error; and
reconstructing the script without the malicious code using the modified AST.
2 . The method of claim 1 , wherein the at least one string in the AST is a child node of the parent operator.
3 . The method of claim 1 , removing comments in the script that are used to obfuscate code.
4 . The method of claim 1 , wherein the parent operator is a first parent operator, further comprising:
identifying, in the AST, a second parent operator associated with the at least one string;
determining another absolute position and length of another node representing the second parent operator in the AST; and
removing additional malicious code from the script based on the another absolute position and length of the another node.
5 . The method of claim 1 , wherein the absolute position is an amount of bytes from the beginning of a file and the length of the node represents an amount of bytes of source code associated with the node.
6 . The method of claim 1 , wherein the parent operator comprises at least one child operator, and wherein removing the malicious code comprises removing code associated with the at least one child operator.
7 . The method of claim 1 , wherein identifying, in the AST, the parent operator associated with the at least one string comprises determining that the parent operator is a statement from the tree that includes the string “Statement” in the name.
8 . The method of claim 1 , wherein identifying the at least one string corresponding to the malicious pattern comprises:
transforming the script into a structured representation that captures lexical, syntactic, and statistical characteristics,
extracting features comprising code complexity metrics, and
classifying the script using a supervised learning model trained on the features.
9 . A system for removing malicious code from a script without compromising script functionality, comprising:
at least one memory;
at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
identify, in a script, at least one string corresponding to a malicious pattern;
generate an abstract syntax tree (AST) of the script;
identify, in the AST, a parent operator associated with the at least one string;
determine an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
remove malicious code from the script without generating syntax errors, including: generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error; and
reconstruct the script without the malicious code using the modified AST.
10 . The system of claim 9 , wherein the at least one string in the AST is a child node of the parent operator.
11 . The system of claim 9 , wherein the at least one hardware processor is further configured to remove comments in the script that are used to obfuscate code.
12 . The system of claim 9 , wherein the parent operator is a first parent operator, wherein the at least one hardware processor is further configured to:
identify, in the AST, a second parent operator associated with the at least one string;
determine another absolute position and length of another node representing the second parent operator in the AST; and
remove additional malicious code from the script based on the another absolute position and length of the another node.
13 . The system of claim 9 , wherein the absolute position is an amount of bytes from the beginning of a file and the length of the node represents an amount of bytes of source code associated with the node.
14 . The system of claim 9 , wherein the parent operator comprises at least one child operator, and wherein removing the malicious code comprises removing code associated with the at least one child operator.
15 . The system of claim 9 , wherein identifying, in the AST, the parent operator associated with the at least one string comprises determining that the parent operator is a statement from the tree that includes the string “Statement” in the name.
16 . The system of claim 9 , wherein identifying the at least one string corresponding to the malicious pattern comprises:
transforming the script into a structured representation that captures lexical, syntactic, and statistical characteristics,
extracting features comprising code complexity metrics, and
classifying the script using a supervised learning model trained on the features.
17 . A non-transitory computer readable medium storing thereon computer executable instructions for removing malicious code from a script without compromising script functionality, including instructions for:
identifying, in a script, at least one string corresponding to a malicious pattern;
generating an abstract syntax tree (AST) of the script;
identifying, in the AST, a parent operator associated with the at least one string;
determining an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
removing malicious code from the script without generating syntax errors, including: generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error; and
reconstructing the script without the malicious code using the modified AST.
18 . The non-transitory computer readable medium of claim 17 , wherein identifying, in the AST, the parent operator associated with the at least one string comprises determining that the parent operator is a statement from the tree that includes the string “Statement” in the name.
19 . The non-transitory computer readable medium of claim 17 , wherein identifying the at least one string corresponding to the malicious pattern comprises:
transforming the script into a structured representation that captures lexical, syntactic, and statistical characteristics,
extracting features comprising code complexity metrics, and
classifying the script using a supervised learning model trained on the features.