Identification of malware
Particular embodiments described herein provide for a system that can be configured to identify cryptomining malware. The electronic device can be configured to identify a website, determine one or more uniform resource locators associated with the website, determine scripts associated with the website, obtain a string format of each of the determined scripts associated with the website, analyze each of the of the string formats to determine if a specific script is related to malware, and block the website if the specific script is related to malware. In an example, the system can also be configured to determine if usage of the computer processing unit and/or system resources increase more than a threshold amount during access to the website and send the one or more uniform resource locators associated with the website to a network security engine for further analysis.
1. A method comprising:
identifying a website;
determining scripts associated with the website using a webextension application programming interface;
blocking the website if a script associated with the website is blacklisted;
obtaining a string format of each of the determined scripts associated with the website using an Extensible Markup Language/Hypertext Transfer Protocol request;
analyzing the string format of each of the determined scripts to determine if a specific script is related to cryptomining malware;
blocking the website if the specific script is related to cryptomining malware; and
sending one or more uniform resource locators associated with the website to a security engine for further analysis when usage of a computer processing unit increases more than a threshold amount over a predetermined amount of time during access to the website; and
communicating, to a user, an option to allow access to the website when usage of the computer processing unit increases more than the threshold amount during access to the website.
2. The method of claim 1 , wherein the string format of each of the determined scripts associated with the website are analyzed using a regular expression analysis to determine if the specific script is related to malware.
3. The method of claim 2 , further comprising:
adding the specific script to a suspicious script database.
4. The method of claim 1 , further comprising:
communicating a notification to a user when usage of the computer processing unit increases more than the threshold amount during access to the website.
5. The method of claim 1 , wherein access to the website and scripts related to the website are blocked if the user does not allow access to the website.
6. The method of claim 1 , further comprising:
determining if an application and/or scripts related to the website are causing the increase in the usage of the computer processing unit.
7. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
identify a website;
determine scripts associated with the website using a webextension application programming interface;
block the website if a script associated with the website is blacklisted;
obtain a string format of each of the determined scripts associated with the website using an Extensible Markup Language/Hypertext Transfer Protocol request;
analyze the string format of each of the determined scripts to determine if a specific script is related to cryptomining malware;
block the website if the specific script is related to cryptomining malware;
send one or more uniform resource locators associated with the website to a security engine for further analysis when an application and/or scripts related to the website cause usage of a computer processing unit to increase more than a threshold amount during access to the website; and
communicate, to a user, an option to allow access to the website when usage of the computer processing unit increases more than the threshold amount during access to the website.
8. The at least one computer-readable medium of claim 7 , wherein the string format of each of the determined scripts associated with the website are analyzed using a regular expression analysis to determine if the specific script is related to malware.
9. The at least one computer-readable medium of claim 8 , further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
add the specific script to a suspicious script database.
10. The at least one computer-readable medium of claim 7 , comprising one or more instructions that when executed by at least one processor, further cause the at least one processor to:
communicate a notification to a user when usage of the computer processing unit increases more than the threshold amount during access to the website.
11. The at least one computer-readable medium of claim 7 , wherein access to the website and scripts related to the website are blocked if the user does not allow access to the website.
12. An apparatus to determine a presence of cryptomining malware, the apparatus comprising:
memory;
at least one processor; and
a security engine, the security engine configured to:
identify a website;
determine one or more uniform resource locators associated with the website using a webextension application programming interface;
block the website if a uniform resource locator associated with the website is blacklisted;
determine scripts associated with the website;
block the website if a script associated with the website is blacklisted;
obtain a string format of each of the determined scripts associated with the website using an Extensible Markup Language/Hypertext Transfer Protocol request;
analyze the string format of each of the determined scripts to determine if a specific script is related to cryptomining malware;
block the website if the specific script is related to cryptomining malware;
send one or more uniform resource locators associated with the website to a security engine for further analysis when an application and/or scripts related to the website cause usage of a computer processing unit increases to increase more than a threshold amount over a predetermined amount of time during access to the website; and
communicate, to a user, an option to allow access to the website when usage of the computer processing unit increases more than the threshold amount during access to the website.
13. The apparatus of claim 12 , wherein the string format of each of the determined scripts associated with the website are analyzed using a regular expression analysis to determine if the specific script is related to malware.
14. The apparatus of claim 13 , wherein the security engine is further configured to:
add the specific script to a suspicious script database.
15. The apparatus of claim 12 , wherein the security engine is further configured to:
communicate a notification to a user when usage of the computer processing unit increases more than the threshold amount during access to the website.
16. The apparatus of claim 12 , wherein access to the website and scripts related to the website are blocked if the user does not allow access to the website.