초록 ▼

Provided are a system and method for detecting a malicious script. The system includes a script decomposition module for decomposing a web page into scripts, a static analysis module for statically analyzing the decomposed scripts in the form of a document file, a dynamic analysis module for dynamic

Provided are a system and method for detecting a malicious script. The system includes a script decomposition module for decomposing a web page into scripts, a static analysis module for statically analyzing the decomposed scripts in the form of a document file, a dynamic analysis module for dynamically executing and analyzing the decomposed scripts, and a comparison module for comparing an analysis result of the static analysis module and an analysis result of the dynamic analysis module to determine whether the decomposed scripts are malicious scripts. The system and method can recognize a hidden dangerous hypertext markup language (HTML) tag irrespective of an obfuscation technique for hiding a malicious script in a web page and thus can cope with an unknown obfuscation technique.

대표청구항 ▼

1. A system for detecting a malicious script, comprising: a computer processor executing instructions for performing steps of:downloading a web page to a web browser;decomposing the downloaded web page into scripts, extracting the scripts from the web page, generating a hypertext markup language (HT

1. A system for detecting a malicious script, comprising: a computer processor executing instructions for performing steps of:downloading a web page to a web browser;decomposing the downloaded web page into scripts, extracting the scripts from the web page, generating a hypertext markup language (HTML) document for each of the extracted scripts and storing each of the generated HTML documents;performing a static analysis on each of the HTML documents by opening each HTML document with a text editor and counting the number of times that a signature of each dangerous HTML tag included in a dangerous HTML tag database is identical to text patterns of each of the scripts corresponding to the HTML documents;performing a dynamic analysis that dynamically executes each of the HTML documents through the web browser and uses a plug-in which operates in a memory area of the web browser to analyze each of the scripts corresponding to the HTML documents in a completed script execution state by accessing results of the executed HTML documents using a function provided by the web browser and counting the number of times that the content of each of the results of the dynamically executed HTML documents is identical to each signature included in the dangerous HTML tag database; andperforming a comparison for each of the scripts of the web page that compares the number of times counted by the static analysis with the number of times counted by the dynamic analysis, wherein a script of the scripts from the web page is determined as a malicious script when the number of times counted by the static analysis and the number of times counted by the dynamic analysis are different. 2. The system of claim 1, further comprising a step of analyzing an Internet protocol (IP) address and domain information of a redirection site to detect a web page spreading malicious code. 3. The system of claim 2, wherein the IP address analysis detects the web page spreading malicious code using geographic location information on the IP address, and the domain information analysis detects the web page spreading malicious code using a degree of similarity between domain information included in the decomposed scripts and domain information on a website being visited. 4. The system of claim 2, further comprising a step of checking whether a whitelist signature known to be normal is included in a script determined to be malicious, and filtering the script determined to be malicious as a normal script when the whitelist signature is included in the script. 5. The system of claim 1, wherein the dynamic analysis obtains information on final results of executing the HTML documents in communication with a script execution element of the web browser. 6. A method of detecting a malicious script, comprising: downloading a web page to a web browser;decomposing the downloaded web page into scripts, extracting the scripts from the web page, generating a hypertext markup language (HTML) document for each of the extracted scripts and storing each of the generated HTML documents;statically analyzing each of the HTML documents by opening each HTML document with a text editor and counting the number of times that a signature of each dangerous HTML tag included in a dangerous HTML tag database is identical to text patterns of each of the scripts corresponding to the HTML documents;executing each of the HTML documents through the web browser and using a plug-in which operates in a memory of the web browser to analyze the scripts corresponding to the HTML documents in a completed script execution state by accessing results of the executed HTML documents using a function provided by the web browser and counting the number of times that content of each of the results of the dynamically executed HTML documents is identical to each signature included in the dangerous HTML tag database; andcomparing, for each of the scripts of the web page, the number of times counted by the static analysis with the number of times counted by the dynamic analysis, wherein a script of the scripts from the web page is determined as a malicious script when the number of times counted by the static analysis and the number of times counted by the dynamic analysis are different. 7. The method of claim 6, further comprising analyzing an Internet protocol (IP) address and domain information of a site to which redirection is performed by a script determined to be malicious to detect a web page spreading malicious code. 8. The method of claim 7, wherein analyzing the IP address includes detecting the web page spreading malicious code using geographic location information on the IP address, and analyzing domain information includes detecting the web page spreading malicious code using a degree of similarity between domain information included in the content of each of the dynamically executed HTML documents and domain information on a website being visited. 9. The method of claim 7, further comprising checking whether a whitelist signature known to be normal is included in the script determined to be malicious and filtering the script determined to be malicious as a normal script when the whitelist signature is included in the script. 10. The method of claim 6, wherein dynamically analyzing the HTML documents further includes obtaining information on final results of executing the HTML documents scripts in communication with a script execution element of the web browser.