# US 2021/0240827 A1 · Apparatus and method for detecting malicious script > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240827 A1 - Document ID: US20210240827A1 - Status: Published application - Kind: A1 - Application number: 17/100,541 - Filed: 2020-11-20 - Published: 2021-08-05 - Earliest claimed: 2020-02-05 - Assignees: Electronics and Telecommunications Research Institute - Applicants: Electronics and Telecommunications Research Institute - Inventors: Jung-Tae KIM; Ji-Hyeon SONG; Ik-Kyun KIM; Young-Su KIM; Jong-Hyun KIM; Jong-Geun PARK; Sang-Min LEE; Jong-Hoon LEE - Web page: https://patentgrep.com/patent/US20210240827A1 ## CPC - G06F 21/563: {by source code analysis} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06N 20/20: Ensemble learning - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Disclosed herein are an apparatus and method for detecting a malicious script. The apparatus includes one or more processors and executable memory for storing at least one program executed by the one or more processors. The at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, to train two learning models to respectively learn two pieces of learning data that are generated in consideration of features extracted respectively from the token-type features and the node-type features as having the highest frequency, and to detect whether the script is a malicious script based on the result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models. ## Claims ### Claim 1 An apparatus for detecting a malicious script, comprising: one or more processors; and executable memory for storing at least one program executed by the one or more processors, wherein the at least one program is configured to extract token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, train two learning models to respectively learn two pieces of learning data generated in consideration of features extracted respectively from the token-type features and the tree-node-type features as having a highest frequency, and detect whether the script is a malicious script based on a result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the token-type features include at least one of a command type for a command included in the script, a parameter type used along with the command, an argument type used along with the command, a keyword type included in the script, and a variable type included in the script. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the tree-node-type features correspond to an N-GRAM sequence extracted from the abstract syntax tree using an N-GRAM algorithm. ### Claim 4 (depends on 3) The apparatus of claim 3, wherein the at least one program sets two weights based on a similarity acquired by comparing the script with each of a previously stored normal script and a previously stored malicious script with respect to the token-type features and the tree-node-type features. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the at least one program groups the features extracted as having the highest frequency according to types of functions performed by the features extracted as having the highest frequency in the normal script and the malicious script. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the at least one program sets the two weighs based on the features extracted as having the highest frequency and generates the ensemble detection model by applying the two weights to the two learning models, respectively. ### Claim 7 A method for detecting a malicious script, performed by a malicious script detection apparatus, comprising: extracting token-type features, each of which corresponds to a lexical unit, and tree-node-type features of an abstract syntax tree from an input script, training two learning models to respectively learn two pieces of learning data generated in consideration of features extracted respectively from the token-type features and the tree-node-type features as having a highest frequency, and detecting whether the script is a malicious script based on a result of ensemble-based malicious script detection performed for the script, which is acquired using an ensemble detection model generated from the two learning models. ### Claim 8 (depends on 7) The method of claim 7, wherein the token-type features include at least one of a command type for a command included in the script, a parameter type used along with the command, an argument type used along with the command, a keyword type included in the script, and a variable type included in the script. ### Claim 9 (depends on 8) The method of claim 8, wherein the tree-node-type features correspond to an N-GRAM sequence extracted from the abstract syntax tree using an N-GRAM algorithm. ### Claim 10 (depends on 9) The method of claim 9, wherein training the two learning models is configured to set two weights based on a similarity acquired by comparing the script with each of a previously stored normal script and a previously stored malicious script with respect to the token-type features and the tree-node-type features. ### Claim 11 (depends on 10) The method of claim 10, wherein detecting whether the script is a malicious script is configured to group the features extracted as having the highest frequency according to types of functions performed by the features extracted as having the highest frequency in the normal script and the malicious script. ### Claim 12 (depends on 11) The method of claim 11, wherein detecting whether the script is a malicious script is configured to set the two weighs based on the features extracted as having the highest frequency and to generate the ensemble detection model by applying the two weights to the two learning models, respectively.