Automated Malicious Code Detection

Reliable Software Technologies proposes to investigate the feasibilityof integrating its successful intrusion detection technology with itstechnology for wrapping the Microsoft Windows components that executeJavaScript, VBScript, and other scripting languages. We also propose toinvestigate the feasibility of generating virtual execution traces using uniquefeatures of the Microsoft scripting architecture. These capabilities arecrucial for building a framework which, without human intervention, notonly learns to recognize new malicious scripts based on previouslyidentified malicious scripts, but also blocks their actions before theycan do damage. Such a framework would significantly reduce the threatposed by malicious scripts, as scripts become an increasingly more commoncomponent in Windows-based information infrastructures.The dependence of modern operating systems on scripting languageswill not decrease with time; Microsoft is heavily committed tightlyintegrating web and scripting support into every aspect of itsapplications and operating system. The explosive growth of thesetechnologies, combined with the lack of any adequate security model,have led to serious security vulnerabilities appearing on a regularbasis. Existing anti-virus products, intrusion detection systems,and firewalls are often unsuccessful at preventing the exploitationof these vulnerabilities. Our approach will help these systems detectand block novel malicious scripts before they can do damage.