Systems and methods for removing malicious code from a script without compromising script functionality
AssigneeCloud Linux Software Inc.
InventorsIgor Seletskiy, Roman Gavrilchenko
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and method for removing malicious code from a script without compromising script functionality. In one aspect, the method includes: identifying, in a script, at least one string corresponding to a malicious pattern; generating an abstract syntax tree (AST) of the script; identifying, in the AST, a parent operator associated with the at least one string; determining an absolute position and length of a node representing the parent operator in the AST; and removing malicious code from the script based on the absolute position and length of the node.
Claims19
A method for removing malicious code from a script without compromising script functionality, the method comprising:
- identifying, in a script, at least one string corresponding to a malicious pattern;
- generating an abstract syntax tree (AST) of the script;
- identifying, in the AST, a parent operator associated with the at least one string;
- determining an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
- removing malicious code from the script without generating syntax errors, including:
- generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error;
- and
- reconstructing the script without the malicious code using the modified AST.
A system for removing malicious code from a script without compromising script functionality, comprising:
- at least one memory;
- at least one hardware processor coupled with the at least one memory and configured, individually or in combination, to:
- identify, in a script, at least one string corresponding to a malicious pattern;
- generate an abstract syntax tree (AST) of the script;
- identify, in the AST, a parent operator associated with the at least one string;
- determine an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
- remove malicious code from the script without generating syntax errors, including:
- generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error;
- and
- reconstruct the script without the malicious code using the modified AST.
A non-transitory computer readable medium storing thereon computer executable instructions for removing malicious code from a script without compromising script functionality, including instructions for:
- identifying, in a script, at least one string corresponding to a malicious pattern;
- generating an abstract syntax tree (AST) of the script;
- identifying, in the AST, a parent operator associated with the at least one string;
- determining an absolute position and length of a node representing the parent operator and at least one child operator in the AST;
- removing malicious code from the script without generating syntax errors, including:
- generating a modified AST by removing the node, wherein removing the node includes removing code associated with the node based on the absolute position and the length of the node, wherein removing the at least one string from the script generates a syntax error and removing the code comprising parent operator and the at least one string does not generate the syntax error;
- and
- reconstructing the script without the malicious code using the modified AST.
Dependencies are inferred from the claim text.