Systems and methods for detecting malicious code
AssigneeVeriSign, Inc.
InventorsMatthew Cote, Trevor Tonn
Life of this patent
Estimating the term…
Abstract
A system, method, and computer-readable medium for detecting malicious computer code are provided. Instructions, such as HTML or JavaScript instructions may be received from a server, parsed, and executed. During execution of the instructions, one or more functions of a software application, such as a web browser, may be hooked, and an event object may be created for each called function that is hooked, resulting in a collection of event objects. Rules may be matched with event objects of the collection of event objects to detect malicious code. Attributes from the matched event objects may then be used to locate original malicious script or code injected into a web page.
Claims22
A computer-implemented method for detecting malicious software code, comprising:
- launching, in a computing device of a computer system, a software application comprising a plurality of primary functions for modifying an internal data structure associated with the software application;
- receiving instructions from a server;
- during execution of at least one instruction in the instructions,
- performing a function call of a first primary function of the plurality of primary functions specified in the at least one instruction,
- intercepting the function call prior to the internal data structure being modified by an execution of the first primary function,
- in response to the function call being intercepted, calling and executing a secondary function to create a first event object, the first event object including one or more attributes related to the function call, and
- storing the first event object in a collection of event objects associated with the instructions, wherein each event object stored in the collection of event objects is created by a separate execution of the secondary function and in response to a separate function call of at least one primary function included in the plurality of primary functions;
- determining that a rule is satisfied based on applying one or more conditions of the rule to the collection of event objects;
- and
- identifying, based on the determination that the rule is satisfied, the instructions as malicious software code.
A system for detecting malicious software code, the system comprising:
- a memory storing program code;
- and
- a processor executing the program code to:
- launch, in a computing device of a computer system, a software application comprising a plurality of primary functions for modifying an internal data structure associated with the software application;
- receive instructions from a server;
- during execution of at least one instruction in the instructions,
- perform a function call of a first primary function of the plurality of primary functions specified in the at least one instruction,
- intercept the function call prior to the internal data structure being modified by an execution of the first primary function,
- in response to the function call being intercepted, call and execute a secondary function to create a first event object, the first event object including one or more attributes related to the function call, and
- store the first event object in a collection of event objects associated with the instructions, wherein each event objects stored in the collection of event objects is created by a separate execution of the secondary function and in response to a separate function call of at least one primary function included in the plurality of primary functions;
- determine that a rule is satisfied based on applying one or more conditions of the rule to the collection of event objects;
- and
- identify, based on the determination that the rule is satisfied, the software application as malicious software code.
One or more non-transitory computer-readable storage media containing program code that, when executed by one or more processors, cause the one or more processors to perform a method comprising:
- launching, in a computing device of a computer system, a software application comprising a plurality of primary functions for modifying an internal data structure associated with the software application;
- receiving instructions from a server;
- during execution of at least one instruction in the instructions,
- performing a function call of a first primary function of the plurality of primary functions specified in the at least one instruction,
- intercepting the function call prior to the internal data structure being modified by an execution of the first primary function,
- in response to the function call being intercepted, calling and executing a secondary function to create a first event object, the first event object including one or more attributes related to the function call, and
- storing the first event object in a collection of event objects associated with the instructions, wherein each of the event objects stored in the collection of event objects is created by a separate execution of the secondary function and in response to a separate function call of at least one primary function included in the plurality of primary functions;
- determining that a rule is satisfied based on applying one or more conditions of the rule to the collection of event objects;
- and
- identifying, based on the determination that the rule is satisfied, the software application as malicious software code.
Dependencies are inferred from the claim text.