Real-time javascript classifier
Aspects of the present disclosure are operable to protect against malicious objects, such as JavaScript code, which may be encountered, downloaded, or otherwise accessed from a content source by a computing system. In an example, antivirus software implementing aspects disclosed herein may be capable of detecting malicious objects in real-time. Aspects of the present disclosure aim to reduce the amount of time used to detect malicious code while maintaining detection accuracy, as detection delays and/or a high false positive rate may result in a negative user experience. Among other benefits, the systems and methods disclosed herein are operable to identify malicious objects encountered by a computing system while maintaining a high detection rate, a low false positive rate, and a high scanning speed.
1. A computer-implemented method for malicious object classification, comprising:
receiving content from a threat processor, the content comprising one or more objects associated with HTML content;
generating one or more feature vectors based on the received content;
providing a classification model trained using a set of content sources known to be benign and a set of content sources known to be malicious; and
evaluating, using the classification model, the one or more feature vectors to generate a score indicating whether the content comprises one or more malicious objects.
2. The computer-implemented method of claim 1 , further comprising providing the generated score to a computing system.
3. The computer-implemented method of claim 2 , wherein providing the generated score comprises providing an indication that the content is one of malicious and benign.
4. The computer-implemented method of claim 1 , wherein receiving content further comprises receiving an identifier associated with the content.
5. The computer-implemented method of claim 4 , further comprising:
determining, based on the identifier, whether a score is available in a threat data store for the content;
based on determining that a score is available, accessing the threat data store to retrieve the score for the content; and
providing the score to a computing system.
6. The computer-implemented method of claim 1 , further comprising:
crawling one or more content sources from a set of content sources known to be benign and a set of content sources known to be malicious to update the classification model.
7. The computer-implemented method of claim 6 , wherein crawling the one or more content sources comprises:
identifying one or more objects within content from the one or more content sources;
tokenizing at least one of the one or more objects identified from within the content from the one or more content sources to generate a set of tokens;
generating a set of raw features based on the set of tokens; and
generating a set of abstract features based on the set of raw features.
8. A system comprising:
at least one processor; and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method comprising:
receiving content from a threat processor, the content comprising one or more objects associated with HTML content;
generating one or more feature vectors based on the received content;
transmitting the one or more feature vectors to a security service;
receiving, from the security service, a score associated with the feature vectors, the score based on an evaluation of the one or more feature vectors by a classification model;
determining, based on the score, whether the content comprises one or more malicious objects; and
when it is determined that the content comprises one or more malicious objects, blocking the one or more malicious objects.
9. The system of claim 8 , wherein generating the one or more feature vectors comprises:
identifying the one or more objects within the content;
tokenizing at least one of the one or more objects identified from within the content to generate a set of tokens;
generating a set of raw features based on the set of tokens; and
generating a set of abstract features based on the set of raw features.
10. The system of claim 9 , wherein the method further comprises determining whether a local threat data store is useable to determine a score for the feature vectors.
11. The system of claim 10 , wherein the one or more feature vectors are transmitted to the security service when it is determined that the local threat data store is not useable to determine a score for the feature vectors.
12. The system of claim 8 , wherein determining whether the content comprises one or more malicious objects comprises evaluating the received score based on a threshold.
13. The system of claim 8 , wherein transmitting the one or more feature vectors to the security service further comprises transmitting an identifier associated with the content to the security service.
14. The system of claim 8 , wherein the content is a webpage, and wherein the one or more malicious objects are JavaScript objects.
15. A computer-implemented method for performing malicious object classification at a computing system, comprising:
generating, by the computing system, one or more feature vectors based on content;
transmitting the one or more feature vectors to a security service;
receiving, from the security service, a score associated with the feature vectors, the score based on an evaluation of the one or more feature vectors by a classification model;
determining, based on the score, whether the content comprises one or more malicious objects; and
based on determining that the content comprises one or more malicious objects, blocking the one or more malicious objects.
16. The computer-implemented method of claim 15 , wherein generating the one or more feature vectors comprises:
identifying one or more objects within the content;
tokenizing at least one of the one or more objects to generate a set of tokens;
generating a set of raw features based on the set of tokens; and
generating a set of abstract features based on the set of raw features.
17. The computer-implemented method of claim 15 , wherein the method further comprises determining whether a threat data store local to the computing system is useable to determine a score for the feature vectors.
18. The computer-implemented method of claim 17 , wherein the one or more feature vectors are transmitted to the security service when it is determined that the threat data store is not useable to determine a score for the feature vectors.
19. The computer-implemented method of claim 15 , wherein determining whether the content comprises one or more malicious objects comprises evaluating the received score based on a threshold.
20. The computer-implemented method of claim 15 , wherein the content is a webpage, and wherein the one or more malicious objects are JavaScript objects.