Malicious script detection method and device, electronic device and storage medium

Abstract

The invention discloses a malicious script detection method and device, an electronic device and a storage medium. The method includes the steps of loading the script code in a target scrip file to avirtual system for simulation running; scanning the script code and obtaining the characteristic information of the script code in the script code simulation running process; according to the characteristic information of the script code, determining whether the target script file is a malicious script file. Through adoption of the embodiment of the invention, the effectiveness of malicious scriptdetection can be improved.

Description

technical field [0001] The invention relates to the technical field of computer applications, in particular to a detection method, device, electronic equipment and storage medium for malicious scripts. Background technique [0002] JavaScript is a common WEB scripting language. Because of its advantages of providing dynamic pages and making different responses according to user input, JavaScript has become the scripting language chosen for almost all front-end development of websites, but it is also because it can run dynamically With the feature of completing specific functions, JavaScript script files often become the source of malicious codes, posing a serious threat to the safe operation of user terminals. [0003] Existing JavaScript script code detection technologies include static scanning technology and sandbox technology. Among them, on the one hand, the static scanning technology matches the script code of the target JavaScript file with the collected virus signat...

AI Technical Summary

Problems solved by technology

However, in cases where JavaScript uses encryption, static scanning techniques fail

On the other hand, in the sandbox technology, the anti-virus software is used to hook the core functions in the JavaScript analysis engine, so that when the JavaScript script runs to the preset condition (such as the completion of the decryption operation), it will be intercepted by the anti-virus software and perform feature matching. It can avoid the ineffectiveness of detection caused by script encryption, but due to the large number of JavaScript engine versions, it is almost impossible to obtain a sandbox compatible with all engines, and once some important hook points are missed, it will still cause sandbox escape. Therefore, the sandbox technology is not only complicated to implement, but also the effectiveness of malicious script detection cannot be guaranteed

Images