Patent ID: 9680848
Date: 2017-06-13
CPC Classifications: G06F,H04L

Claim:
1. An apparatus for detecting and preventing malicious scripts, comprising: a signature management unit managing a first signature including code pattern information of previously-detected malicious scripts; a script analysis unit receiving the first signature from the signature management unit and analyzing a first script, which is included in a web page, using the first signature; and a script processing unit receiving analysis result data from the script analysis unit and processing the first script according to the analysis result data, wherein the script analysis unit includes a static analysis unit and a dynamic analysis unit, the static analysis unit analyzes a code pattern of the first script using the first signature and provides a second script, which is part of the first script not matching the first signature, to the dynamic analysis unit, and the dynamic analysis unit generates a first call trace including Application Programming Interface (API) flow information for the second script, receives a second signature including a second call trace of the previously-detected malicious scripts, and analyzes the first call trace using the second signature, and wherein the dynamic analysis unit includes a call trace generation module and the call trace generation module generates an API trace for the second script and generates the first call trace by Extensible Mark-up Language (XML)-converting the generated API trace.