Systems and methods for tracking execution flows for automated malware detection

A system for detecting malware in scripts, the system comprising:

• at least one memory;
• and
• at least one hardware processor communicatively coupled with the at least one memory and configured, individually or in combination, to:
• monitor, at a first computing device, an execution flow of at least one portion of a script;
• compute a fingerprint that represents the execution flow;
• determine whether the fingerprint is present in a local fingerprint database that comprises a plurality of entries for known scripts;
• in response to determining that the fingerprint is not present in the local fingerprint database, transmit the fingerprint to a central database server comprising a universal fingerprint database;
• in response to receiving an indication that the fingerprint is not present in the universal fingerprint database, scan the at least one portion of the script for malware;
• block the at least one portion of the script in response to determining that the script comprises malware based on the scanning;
• determine whether the at least one portion of the script associated with the fingerprint has a different version with a fingerprint in the local fingerprint database;
• in response to determining that the at least one portion of the script has the different version, determine whether the different version is a latest version of the at least one portion of the script;
• and
• in response to determining that the different version is not the latest version, identify the fingerprint as a candidate fingerprint for inclusion in the universal fingerprint database and transmitting the fingerprint to the central database server.

A non-transitory computer readable medium storing thereon computer executable instructions for detecting malware in scripts, including instructions for:

• monitoring, at a first computing device, an execution flow of at least one portion of a script;
• computing a fingerprint that represents the execution flow;
• determining whether the fingerprint is present in a local fingerprint database that comprises a plurality of entries for known scripts;
• in response to determining that the fingerprint is not present in the local fingerprint database, transmitting the fingerprint to a central database server comprising a universal fingerprint database;
• in response to receiving an indication that the fingerprint is not present in the universal fingerprint database, scanning the at least one portion of the script for malware;
• blocking the at least one portion of the script in response to determining that the script comprises malware based on the scanning;
• determining whether the at least one portion of the script associated with the fingerprint has a different version with a fingerprint in the local fingerprint database;
• in response to determining that the at least one portion of the script has the different version, determining whether the different version is a latest version of the at least one portion of the script;
• and
• in response to determining that the different version is not the latest version, identifying the fingerprint as a candidate fingerprint for inclusion in the universal fingerprint database and transmitting the fingerprint to the central database server.