System and method for circumventing evasive code for cyberthreat detection
One embodiment of the described invention is directed to a computerized method for improving detection of cybersecurity threats initiated by a script. Herein, the method is configured to analyze the script provided as part of a script object by at least (i) determining whether any functional code blocks forming the script include a critical code statement, (ii) determining whether any of the functional code blocks include an evasive code statement, (iii) modifying the script to control processing of a subset of the functional code blocks by avoiding an execution code path including the evasive code statement and processing functional code blocks forming a code path including the critical code statement, and (iv) executing of the modified script and monitoring behaviors of a virtual environment. Thereafter, the method is configured to determine whether the script including cybersecurity threats based on the monitored behaviors.
1. A system for improved detection of cybersecurity threats initiated by a script, comprising:
a processor; and
a non-transitory storage medium communicatively coupled to the processor and configured to store
multi-stage analytic engine configured to analyze the script provided as part of a script object by at least (i) determining whether any functional code blocks forming the script include a critical code statement, (ii) determining whether any of the functional code blocks include an evasive code statement, (iii) modifying the script to control processing of a subset of the functional code blocks by avoiding an execution code path including the evasive code statement and processing functional code blocks forming a code path including the critical code statement, and (iv) executing the modified script and monitoring behaviors of a virtual environment,
a classification engine configured to receive the behaviors associated with the script to determine whether the script including cybersecurity threats, and
an alert engine configured to receive results produced from the classification engine and generate one or more alert messages organizing the results of the analyses by the multi-stage analytic engine and results produced from the classification engine.
2. The system of claim 1 , wherein the processor corresponds to a processor instance within a cloud network and the non-transitory storage medium corresponds to a storage instance within the cloud network.
3. The system of claim 1 , wherein the multi-stage analytic engine includes a first analytic stage configured to conduct an initial evaluation of an incoming object to determine whether the object includes the script and corresponds to the script object, a second analytic stage to process the script to recover behaviors based on analysis within the second analytic stage, and a third analytic stage to collect behaviors generated during execution of the modified script.
4. The system of claim 3 , wherein the first analytic stage of the multi-stage analytic engine includes pre-filter logic that is configured to further conduct a preliminary analysis of the script object and either (i) provide the script associated with the script object to the second analytic stage when a classification of the script object is inconclusive or (ii) bypass the second analytic stage and the third analytic stage when the script object is classified as benign or malicious.
5. The system of claim 3 , wherein the second analytic stage of the multi-stage analytic engine includes conditional flow graph generation logic configured to (i) receive the script from the first analytic stage, after being parsed from the script object, (ii) identify (a) the functional code blocks included in the script and (b) relationships between the functional code blocks, wherein the relationships represent one or more interactions between the functional code blocks forming the script, and (iii) generate a conditional flow graph representing the functional code blocks and the relationships between the functional code blocks.
6. The system of claim 5 , wherein the second analytic stage of the multi-stage analytic engine further includes functional code block weighting logic configured to determine whether any of the functional code blocks include a critical code statement by at least (i) analyzing code statements within each functional code block of the functional code blocks to determine whether at least a first level of correlation exists between a code statement within a functional code block of the functional code blocks and code statements associated with known malware and (ii) assigning a threat weight value to identify a likelihood of the functional code block including a critical code statement.
7. The system of claim 6 , wherein the second analytic stage of the multi-stage analytic engine further includes functional code block weighting logic configured to determine whether any of the functional code blocks include an evasive code statement by at least (i) analyzing code statements within each functional code block of the functional code blocks to determine whether any of the code statements include code that precludes or halts the script from completing its execution or intentionally delays execution of other functional code blocks, and (ii) assigning an evasive weight value to identify a likelihood of the functional code block including an evasive code statement.
8. The system of claim 7 , wherein the second analytic stage of the multi-stage analytic engine further includes code execution path prioritization logic configured to distribute both threat weight values and evasive weight values assigned to each of the functional code blocks to identify the code execution path including the evasive code statement.
9. The system of claim 1 , wherein the virtual environment corresponds to one or more virtual machines.
10. The system of claim 1 , wherein the multi-stage analytic engine to analyze the script associated with the script object and, upon detecting that the script object is a protected script object where access to code within the script object is unavailable, extract the script from the script object to produce the script and an unprotected object, store the unprotected object and reinsert the extracted script into the unprotected object to produce the script object for analysis.
11. A computerized method for improved detection of cybersecurity threats initiated by a script, comprising:
analyzing the script provided as part of a script object by at least (i) determining whether any functional code blocks forming the script include a critical code statement, (ii) determining whether any of the functional code blocks include an evasive code statement, (iii) modifying the script to control processing of a subset of the functional code blocks by avoiding an execution code path including the evasive code statement and processing functional code blocks forming a code path including the critical code statement, and (iv) monitoring behaviors during execution of the modified script; and
determining whether the script including cybersecurity threats based on the monitored behaviors.
12. The computerized method of claim 11 , wherein prior to analyzing the script, the computerized method further comprising:
conducting an initial evaluation of an incoming object to determine whether the object includes the script and corresponds to the script object.
13. The computerized method of claim 11 , wherein prior to determining whether any functional code blocks forming the script include a critical code statement, the computerized method further comprising:
conducting a preliminary analysis of the script object and either (i) providing the script associated with the script object to a second analytic stage being logic configured to determine whether any functional code blocks forming the script include a critical code statement or (ii) bypassing the second analytic stage when the script object is classified as benign or malicious.
14. The computerized method of claim 11 , wherein prior to determining whether any functional code blocks forming the script include a critical code statement, the computerized method further comprising:
receiving the script, after being parsed from the script object,
identifying (a) the functional code blocks included in the script and (b) relationships between the functional code blocks, wherein the relationships represent one or more interactions between the functional code blocks forming the script, and
generating a conditional flow graph representing the functional code blocks and the relationships between the functional code blocks.
15. The computerized method of claim 14 , wherein the determining whether any of the functional code blocks include a critical code statement comprises (i) analyzing code statements within each functional code block of the functional code blocks to determine whether at least a first level of correlation exists between a code statement within a functional code block of the functional code blocks and code statements associated with known malware and (ii) assigning a threat weight value to identify a likelihood of the functional code block including a critical code statement.
16. The computerized method of claim 15 , wherein the determining whether any of the functional code blocks include an evasive code statement comprises (i) analyzing code statements within each functional code block of the functional code blocks to determine whether any of the code statements include code that precludes or halts the script from completing its execution or intentionally delays execution of other functional code blocks, and (ii) assigning an evasive weight value to identify a likelihood of the functional code block including an evasive code statement.
17. The computerized method of claim 16 , wherein the modifying of the script to control processing of the subset of the functional code blocks comprises distributing both threat weight values and evasive weight values assigned to each of the functional code blocks to identify the code execution path including the evasive code statement.
18. The computerized method of claim 11 , wherein the modified script is executed in a virtual environment, the virtual environment corresponds to one or more virtual machines.
19. The computerized method of claim 11 , wherein prior to analyzing the script, the computerized method further comprising:
analyzing the script associated with the script object; and
upon detecting that the script object is a protected script object where access to code within the script object is unavailable, extracting the script from the script object to produce the script and an unprotected object, storing the unprotected object, and reinserting the extracted extract into the unprotected object to produce the script object for analysis.
20. A non-transitory storage medium including software that, upon execution by one or more processors, causes the software to detect cybersecurity threats initiated by a script by performing operations comprising:
analyzing the script by at least (i) determining whether any functional code blocks forming the script include a critical code statement, (ii) determining whether any of the functional code blocks include an evasive code statement, (iii) modifying the script to control processing of a subset of the functional code blocks by avoiding an execution code path including the evasive code statement and processing functional code blocks forming a code path including the critical code statement, and (iv) monitoring behaviors during execution of the modified script; and
determining whether the script including cybersecurity threats based on the monitored behaviors.
21. The non-transitory storage medium of claim 20 , wherein prior to analyzing the script, the software performs further operations comprising:
conducting an initial evaluation of an incoming object to determine whether the object includes the script and corresponds to the script object.
22. The non-transitory storage medium of claim 20 , wherein prior to determining whether any functional code blocks forming the script include a critical code statement, the software performs further operations comprising:
conducting a preliminary analysis of the script object and either (i) providing the script associated with the script object to a second analytic stage being logic configured to determine whether any functional code blocks forming the script include a critical code statement or (ii) bypassing the second analytic stage when the script object is classified as benign or malicious.
23. The non-transitory storage medium claim 20 , wherein prior to determining whether any functional code blocks forming the script include a critical code statement, the software performs further operations comprising:
receiving the script, after being parsed from the script object,
identifying (a) the functional code blocks included in the script and (b) relationships between the functional code blocks, wherein the relationships represent one or more interactions between the functional code blocks forming the script, and
generating a conditional flow graph representing the functional code blocks and the relationships between the functional code blocks.
24. The non-transitory storage medium of claim 20 , wherein the determining whether any of the functional code blocks include a critical code statement comprises (i) analyzing code statements within each functional code block of the functional code blocks to determine whether at least a first level of correlation exists between a code statement within a functional code block of the functional code blocks and code statements associated with known malware and (ii) assigning a threat weight value to identify a likelihood of the functional code block including a critical code statement.
25. The non-transitory storage medium of claim 24 , wherein the determining whether any of the functional code blocks include an evasive code statement comprises (i) analyzing code statements within each functional code block of the functional code blocks to determine whether any of the code statements include code that precludes or halts the script from completing its execution or intentionally delays execution of other functional code blocks, and (ii) assigning an evasive weight value to identify a likelihood of the functional code block including an evasive code statement.
26. The non-transitory storage medium of claim 25 , wherein the modifying of the script to control processing of the subset of the functional code blocks comprises distributing both threat weight values and evasive weight values assigned to each of the functional code blocks to identify the code execution path including the evasive code statement.
27. The non-transitory storage medium of claim 20 , wherein the modified script is executed in a virtual environment, the virtual environment corresponds to one or more virtual machines.