International Business Machines Corporation

Robert G Freeman

Gunter Ollmann

David Bryan Dewey

Paul Elliott Griswold

A method and associated system. A first computer executes at least two text blocks of code derived from a script of a web page in response to a request for the web page from a client computer. The text blocks are executed sequentially in a sequential order. The script is a first text block of the at least two text blocks. The execution of one text block of the at least two text blocks by the first computer generates a new text block of code.

Analysis of scripts

A method and system for analyzing scripts. A script is analyzed to determine whether the script includes malicious content. A computer executes at least two text blocks of code derived from a script of a web page. The execution of a text block of the at least two text blocks generates an additional text block of code. The computer determines whether the additional text block includes new code that is malicious. If so, the computer prevents transmission of the web page to a client computer. If not, the computer transmits the web page to the client computer.

A method, apparatus, and computer program product for identifying malware is disclosed. The method identifies processes in a running process list on a host computer system. The method identifies ports assigned to the processes in the running process list on the host computer system. The method determines whether any one of ports that is currently in use in the host computer system is not assigned to any of the processes in the running process list. The method then makes a record that a hidden, running process is present as a characteristic of an attack in response to a determination that one of the ports is currently in use but is not assigned to any of the processes in the running process list in the host computer system.

Detecting malicious use of computer resources by tasks running on a computer system

A system and method to protect web applications from malicious attacks and, in particular, a system and method for identification and blocking of malicious code for web browser script engines. The system includes at least one module configured to protect web applications from malicious attacks by detecting an occurrence of heap spraying and blocking the occurrence of heap spraying.

System and method for identification and blocking of malicious code for web browser script engines

A method and system for analyzing scripts. A script is processed, which executes text blocks of code derived from the script and copied to an output file in a sequential order. The script is the first text block that is copied to the output file. Executing the text blocks includes interpreting each text block to generate and execute a corresponding interpreted block of code. Processing the script results in the text blocks being sequenced in the output file in the sequential order. The text blocks include an original text block of code that includes text that may be directly inferred from text appearing in the script. The blocks of code include a new text block of code, which includes text that may not be directly inferred from text appearing in the script. The new text block is generated from executing the original text block.

Detecting obfuscated attacks on a computer. A first program function is invoked to render static components of a web page and identify program code within the web page or associated file. In response, before executing the identified program code, a malicious-code detector is invoked to scan the identified program code for malicious code. If the malicious-code detector identifies malicious code in the identified program code, the identified program code is not executed. If no malicious code is detected, a second program function generates revised program code from execution of the identified, program code. In response, before executing the revised program code, the malicious-code detector is invoked to scan the revised program code for malicious code. If the malicious-code detector identifies malicious code in the revised program code, the revised program code is not executed.

Growing community of inventors

Chamblee, GA, United States of America

Robert G Freeman