A web page malicious code detect approach based on script execution

Web page malicious code detection is a crucial aspect of Internet security. Current web page malicious codes detection work by checking for "signatures", which attempt to capture (syntactic) characteristics of the known malicious codes. This reliance on a syntactic approach makes such detectors vulnerable to code obfuscations, increasingly used by malicious code writers, which alter syntactic prosperities of the malicious code without affecting their execution behavior significantly. This paper takes the position that the key to web page malicious code lies in their execution behavior. It proposes a script execution behavior feature based framework for analyzing propose of malicious codes and proving properties such as soundness and completeness of these malicious codes. Our approach analyses the script and confirms the script which contains malicious code by finding shellcode, overflow behavior and hidden hyper link. As a concrete application of our approach, we show that the script execution behavior based web page malicious code detector can detect many known malicious code but also the newest malicious code.