Method for detecting malicious scripts through modeling of script structure
Disclosed herein are enhancements for operating a communication network to detect malware in scripts of web applications. In one implementation, a method for modeling the structure of embedded unclassified scripts to compare the abstract dynamism of similar scripts. The method may determine structure of unclassified end user browser script by building abstract structure using code from unclassified end user browser script; compare determined structure of unclassified end user browser script with a plurality of generalized abstract structures; if the determined structure of unclassified end user browser script matches within a predetermined threshold of any of the plurality of generalized abstract structures, then the unclassified end user browser script is classified as benign, otherwise the determined structure is classified as malicious. This, in turn, provides a scalable and efficient way of identifying benign, malicious, known and unknown scripts from a script available in full or in part.
1. A method of detection and protection from script-based attacks comprising:
automatically determining a plurality of generalized abstract structures by:
executing an extractor module to extract a plurality of scripts from a plurality of benign web content and parse script code of the scripts to extract structural features of the scripts; and
executing a script modeler module to build a plurality of abstract structures using the structural features of the scripts, cluster individual ones of the plurality of abstract structures into common clusters of the abstract structures based on a predetermined tree edit distance, and model a generalized abstract structure for each of the common clusters of the abstract structures to determine the plurality of generalized abstract structures;
determining a structure of an unclassified end user browser script by using automation to build an abstract structure using code from the unclassified end user browser script;
comparing the structure of the unclassified end user browser script with the plurality of generalized abstract structures to determine if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures; and
if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures then classifying the unclassified end user browser script as benign, otherwise classifying the unclassified end user browser script as malicious.
2. The method of claim 1 , wherein the abstract structure is at least one of: an abstract syntax tree, a parser tree, and a concrete syntax tree.
3. The method of claim 1 wherein the predetermined tree edit distance comprises a value for a threshold of comparison of one tree to another.
4. The method of claim 1 wherein the plurality of generalized abstract structures comprises generalized abstract syntax trees.
5. The method of claim 1 wherein the plurality of generalized abstract structures are generalized by associating common nodes that are predictive of particular types of scripts.
6. The method of claim 1 wherein the unclassified end user browser script comprises JavaScript.
7. The method of claim 1 wherein the unclassified end user browser script comprises a portion of a script code.
8. One or more non-transitory computer-readable storage media having program instructions stored thereon, wherein the program instructions, when executed by a computing system, direct the computing system to at least:
automatically determine a plurality of generalized abstract structures by:
executing an extractor module to extract a plurality of scripts from a plurality of benign web content and parse script code of the scripts to extract structural features of the scripts; and
executing a script modeler module to build a plurality of abstract structures using the structural features of the scripts, cluster individual ones of the plurality of abstract structures into common clusters of the abstract structures based on a predetermined tree edit distance, and model a generalized abstract structure for each of the common clusters of the abstract structures to determine the plurality of generalized abstract structures;
determine a structure of an unclassified end user browser script by using automation to build an abstract structure using code from the unclassified end user browser script;
compare the structure of the unclassified end user browser script with the plurality of generalized abstract structures to determine if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures; and
if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures then classify the unclassified end user browser script as benign, otherwise classify the unclassified end user browser script as malicious.
9. The one or more non-transitory computer-readable storage media of claim 8 wherein the abstract structure is at least one of: an abstract syntax tree, a parser tree, and a concrete syntax tree.
10. The one or more non-transitory computer-readable storage media of claim 8 wherein the predetermined tree edit distance comprises a value for a threshold of comparison of one tree to another.
11. The one or more non-transitory computer-readable storage media of claim 8 wherein the plurality of generalized abstract structures comprises generalized abstract syntax trees.
12. The one or more non-transitory computer-readable storage media of claim 8 wherein the plurality of generalized abstract structures are generalized by associating common nodes that are predictive of particular types of scripts.
13. The one or more non-transitory computer-readable storage media of claim 8 wherein the unclassified end user browser script comprises JavaScript.
14. The one or more non-transitory computer-readable storage media of claim 8 wherein the unclassified end user browser script comprises a portion of a script code.
15. An apparatus comprising:
one or more non-transitory computer-readable storage media;
a processing system operatively coupled with the one or more non-transitory computer-readable storage media; and
program instructions stored on the one or more non-transitory computer-readable storage media that, when executed by the processing system, direct the processing system to at least:
automatically determine a plurality of generalized abstract structures by:
executing an extractor module to extract a plurality of scripts from a plurality of benign web content and parse script code of the scripts to extract structural features of the scripts; and
executing a script modeler module to build a plurality of abstract structures using the structural features of the scripts, cluster individual ones of the plurality of abstract structures into common clusters of the abstract structures based on a predetermined tree edit distance, and model a generalized abstract structure for each of the common clusters of the abstract structures to determine the plurality of generalized abstract structures;
determine a structure of an unclassified end user browser script by using automation to build an abstract structure using code from the unclassified end user browser script;
compare the structure of the unclassified end user browser script with the plurality of generalized abstract structures to determine if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures; and
if the structure of the unclassified end user browser script matches one or more of the plurality of generalized abstract structures then classify the unclassified end user browser script as benign, otherwise classify the unclassified end user browser script as malicious.
16. The apparatus of claim 15 wherein the abstract structure is at least one of: an abstract syntax tree, a parser tree, and a concrete syntax tree.
17. The apparatus of claim 15 wherein the predetermined tree edit distance comprises a value for a threshold of comparison of one tree to another.
18. The apparatus of claim 15 wherein the plurality of generalized abstract structures comprises generalized abstract syntax trees.
19. The apparatus of claim 15 wherein the plurality of generalized abstract structures are generalized by associating common nodes that are predictive of particular types of scripts.
20. The apparatus of claim 15 wherein the unclassified end user browser script comprises JavaScript.