Method for detecting malicious javascript
View Patent ↗An apparatus and system for scoring and grading websites and method of operation. An apparatus receives one or more Uniform Resource Identifiers (URI), requests and receives a resource such as a webpage, and observes the behaviors of an enhanced browser emulator as controlled by javascript provided by the webpage. The enhanced browser emulator tracks behaviors which when aggregated imply malicious intent.
1. A method for scoring and grading websites by observing script behaviors in a browser emulator, comprising:
providing one or more virtual machines on a computing system comprising a processor configured by an operating system;
providing a communications link for each virtual machine to access hosts coupled to the Internet;
within a virtual machine, providing an enhanced browser emulator application wherein said enhanced browser emulator is enhanced by replacing standard Application Programming Interfaces (APIs), libraries, and functions in a resource from a source website with instrumented operations, wherein the instrumented operations check the number of invocations of any of the APIs, libraries, and functions against a threshold and take action upon reaching the threshold;
receiving a Uniform Resource Identifier (URI) for the source website for which content is to be graded for hostile intent, wherein a URI comprises a protocol and a fully qualified domain name;
requesting by the browser a resource from said source website;
receiving said resource;
determining if shell code is contained within said resource from said source website;
determining if executable code is contained within said resource;
observing a behavior of the enhanced browser emulator as controlled by said executable code contained within the said resource and scoring said behaviors for hostile intent.
2. The method of claim 1 wherein
a behavior comprises:
dynamically changing the location URL of the resource to force a reload of the browser with content from a host not substantially similar to the domain name of the source website.
3. The method of claim 1 wherein
a behavior comprises:
attempting to get a cookie and transmit said cookie to a target other than the source website.
4. The method of claim 3 further comprising:
determining that said target is a host not substantially similar to the domain name of the source website.
5. The method of claim 3 further comprising:
determining that said target is a host on a list of malicious hosts.
6. The method of claim 3 further comprising:
determining that said target is expressed in a further javascript function which requires a browser execution to resolve.
7. The method of claim 1 wherein
the behavior comprises:
requiring a javascript element to dynamically generate an attribute of another javascript element.
8. The method of claim 1 wherein
the behavior comprises:
invoking a document write function to operate on an argument containing iframe src element value of which is substantially similar to a target wherein a target contains a domain name or an Internet Protocol (IP) address.
9. The method of claim 1 wherein
determining if executable code is contained within said resource comprises:
extracting executable code from a pdf file.
10. The method of claim 1 wherein
determining if executable code is contained within said resource comprises:
extracting executable code from a flash file.
11. The method of claim 1 wherein
the resource comprises a webpage, and
the behavior comprises:
inserting an iframe into the webpage.
12. The method of claim 11 wherein
the behavior further comprises:
dynamically generating a target for the iframe.
13. The method of claim 1 wherein
the behavior comprises:
operating an eval function on an argument which is resolved into shell code injection.
14. The method of claim 1 wherein
the behavior comprises:
operating a document write function on an argument which is resolved into shell code injection code.
15. The method of claim 1 wherein
the behavior comprises:
operating a createElements function enough times to exceed a threshold whereby memory manipulation can be exploited.
16. The method of claim 1 wherein
the behavior comprises:
operating a concatentation function to create a string large enough to exceed a threshold whereby memory can be exploited.
17. The method of claim 1 wherein
the behavior comprises:
operating a javascript sequence previously determined to be malicious.
18. The method of claim 1 further comprising:
determining a total score for a website from the scores of the behaviors of javascript within a browser emulator, and
determining a grade for the website by comparing the total score to one or more thresholds.
19. The method of claim 1 wherein
some of the instrumented operations examine attributes of the APIs, libraries, and functions and determine if any of the attributes require evaluation.
20. The method of claim 1 wherein
said enhanced browser comprises at least one enhanced script function which flags when it is invoked, writes details to a log and self analyzes the result of its execution.