FR2974203A1 - Method for normalizing script program for detection of attack in computer network, involves performing series of transformations with script input, and storing transformations in database, where result of execution of script is not modified - Google Patents

Abstract

The method (C) involves performing (C2) a series of transformations with script inputs (E0, E0-simp) at a time period, and providing a transformed script as output. The series of transformations is stored in a transformations database (1), and a result of execution of a program script is not modified. The transformation is carried out for additional number of times if the transformed script is different from the script inputs. A lexical analysis step is performed prior to performing the series of transformations. The script program is written in JavaScript(RTM: Programming language to give sophisticated functionality to web pages). Independent claims are also included for the following: (1) a computer system for normalizing a script program (2) a method for detection of attacks on a data processing network (3) a computer system for detection of attacks on a data processing network.

Description

The present invention relates to a method and system for detecting attacks in a computer network, based on the standardization of script-type programs. BACKGROUND OF THE INVENTION which pass through the network. Typically, firewall type devices are placed in one or more locations of the computer network that are to be protected from outside attacks. Such attacks can take the form of malicious scripts, which are scripts containing malicious instructions, which are associated for example with web pages circulating on the network. One of the major problems in analyzing such firewall attacks is understanding what the script associated with a web page will do before making this page available to the client. Such an analysis must be carried out in real time so as not to slow down the traffic. For this purpose, the firewalls integrate protocol analysis modules, making it possible to verify that the incoming data conforms to a specific protocol. But such an analysis does not make it possible to determine that a script is malicious, because such a script containing malicious instructions may very well conform to the protocol being monitored. Devices are known which consist in locating in the analyzed data stream the locations where such scripts are located. Once a script is located, its signature is determined and compared with a list of malicious script signatures. To thwart such devices, people generating malicious data to attack a network use techniques to bypass the aforementioned checks. One of these techniques is to complicate the code of a script to hide the malicious parts of this script.

Indeed, some of the languages, such as JavaScript, used to write these scripts are flexible enough to allow the same operation to be expressed in quite different ways. The object of the present invention is therefore to provide a solution to the aforementioned problems among other problems. In particular, the object of the present invention is to provide a method and an attack detection system on a computer network, based on a real-time analysis for detecting masked attacks in scripts. The invention thus relates, according to a first aspect, to a method for normalizing a script-type program comprising a transformation step during which a series of n1 transformations is executed a first time, with as input the script and output a first transformed script. The transformations are stored in a database of transformations and do not modify the result of the execution of the script program. Thus, the standardization makes it possible in particular to simplify the script and to highlight hidden attacks. In a first implementation variant, after the first execution of the transformation step, and if the first transformed script is different from the script, the transformation step is executed one or more times, with the script as input The transform obtained during the previous execution of the transformation step, until the transformed script is the same as the script transformed into an input. In a second implementation variant, possibly in combination with the previous one, the method comprises, prior to the transformation step, a lexical analysis step during which the script data is compared with lexical data stored in the database. a base of 30 lexical data. Unnecessary data is then removed from the script based on the comparison, to form a simplified script. The transformation step is then executed the first time with as input the simplified script. The invention also relates, according to a second aspect, to a computer system for standardizing a script-type program. The system includes a database of transformations in which is stored a series of n1 transformations that do not modify the result of the execution of the script. The system also includes a transformation module adapted to apply the series of transformations to the script so as to generate a first transformed script.

In a first embodiment, the transformation module is able to apply the series of transformations one or more times, with the input transformed script obtained during the previous application of the series of transformations, until the script transformed into output is identical to the script transformed into input.

In a second variant, possibly in combination with the previous one, the system comprises a lexical database in which lexical data are stored, and a lexical analysis module able to compare the script data and the lexical data and to delete the lexical data. script useless data according to the comparison, to form a simplified script. According to a third aspect, the invention furthermore relates to a method for detecting attacks on a computer network, comprising a step of analyzing data intended to circulate on the network in order to identify a script-type program in the data, and a step of extracting a script identified during the analysis step. The method further comprises a step of implementing the normalization method as presented above, applied to the script extracted during the extraction step. In an implementation variant, the method comprises an evaluation step during which the standardized script is compared with malicious script signatures and / or malicious code sequences stored in one or more signature databases and / or malicious code sequences. When the judging step indicates that the normalized script corresponds to a malicious script signature and / or contains a malicious code sequence, a cleanup step is performed in which all or part of the script identified during extraction step is removed from the analyzed data during the analysis step, to form cleaned data, before delivery of this cleaned data to their recipient or customer. Alternatively, when the evaluation step indicates that the standardized script corresponds to a malicious script signature and / or contains a malicious code sequence, the cleaning step implemented consists in blocking the data analyzed during the step analysis before penetrating this data on the network. The invention finally relates, in a fourth aspect, to a computer system for detecting attacks on a computer network, comprising an analysis module able to analyze the data intended to circulate on the network and to identify a program of the type script in the data, and an extraction module able to extract data from an identified script. The system further includes a standardization computer system as discussed above.

In a first embodiment, the system comprises at least one database of signatures and / or code sequences in which malicious signatures and / or code sequences are stored, and an evaluation module able to compare a script. standardized with malicious script signatures and / or malicious code sequences.

The system may also comprise a cleaning module able to remove, from the data analyzed by the analysis module, all or part of a script whose evaluation of the corresponding standardized script program by the evaluation module indicates that it corresponds a malicious script signature and / or contains a malicious code sequence, to form cleaned data, before delivery of this cleaned data to their recipient or client. Alternatively, the system may comprise a cleaning module able to block the data analyzed by the analysis module, when they contain a script whose evaluation of the corresponding standardized script by the evaluation module indicates that it corresponds to a malicious script signature and / or contains a malicious code sequence, before penetration of the data on the network.

Other features and advantages of the invention will appear more clearly and completely on reading the following description of the preferred variants of embodiment and implementation, which are given by way of nonlimiting examples and with reference In the following appended drawings: FIG. 1 shows schematically both an example of the method and an example of the computer system for detecting attacks in a computer network, according to the invention; FIG. 2 schematically represents both an example of script normalization method and an example of the script normalization system, according to the invention, - Figure 3: schematically represents the application of a transformation in the sense of the invention to a script of JavaScript type. An example of a method and computer system for detecting attacks in a computer network 11 is shown in FIG. 1. The detection system can for example be integrated into a firewall placed at the entrance to the network 11 that is seeks to protect. This detection system comprises an analysis module 6 which receives as input data packets d intended for one or more clients arranged in the network 11. This analysis module 6 implements a step of analysis (A) of the data 25 received at the input which are intended to circulate on the network 11. Such an analysis can be of the type of analysis of conformity of the data d to a determined protocol, such as the HTTP protocol for example. Such an analysis therefore makes it possible to locate the presence of a script-type program, for example written in JavaScript, in the data d, and thus to identify such a script. The detection system also comprises an extraction module 7 implementing an extraction step (B) of a script identified by the analysis module 6 during the analysis step (A). In other words, if the analysis module 6 identifies a script in the data it has received as input, it transmits the input data of the extraction module 7 so that it extracts the script identified E.

Conversely, as shown in FIG. 6, if the analysis module 6 does not identify a script in the data it has received as input, this data is forwarded on the network 11, directly or possibly after undergoing other checks or manipulations. The script Bo extracted by the extraction module 7 in step (B) is then transmitted to the input of a normalization computer system 8 according to the invention, which will be described in more detail below with reference to FIG. 2. This standardization computer system 8 thus allows the implementation of the method (C) of normalization according to the invention, which will also be described in more detail below with reference to FIG. 2.

Once the Bo script is normalized, that is, transformed into a script Si (i> _0) somehow simplified but whose execution gives exactly the same result as the execution of the non-standardized Bo script, it is transmitted to an evaluation module 9 which will allow, during the implementation of an evaluation step (D), to determine whether the script is malevolent or not.

To determine whether or not the standard script Si is malicious, for example, it is possible to use the notion of signature of this malicious script and / or malicious code sequence contained in a script. Thus, when the evaluation module 9 is connected to one or more databases of signatures and / or malicious code sequences 5, it can compare the signature of the normalized script If it has received input and / or the code sequences of this script, to those contained in the database or databases 5. As shown in Figure 1, at the evaluation step (D), if the signature of the normalized script Si does not match to one or the other of the malicious signatures stored in the database or databases 5, and / or if none of the code sequences of the normalized script Si correspond to one or the other of the malicious code sequences stored in the database or databases 5, the data received at the input of the analysis module 6 are conveyed on the network 11, directly or possibly after having undergone other checks or manipulations. On the other hand, if the evaluation step (D) implemented by the evaluation module 9 shows that the signature of the normalized script Si and / or at least one code sequence of the normalized Si respectively correspond to a malicious signature. and / or a malicious code sequence stored in the database or databases 5, then the data d are not transmitted as such for routing on the network 11.

Thus, this data d may possibly be fully routed on the network 11, associated with an alert message. These data d can also or alternatively be transmitted to a cleaning module 10, for carrying out a cleaning step (E). Such a cleaning module 10 may for example remove all or part of the Eo script from the data d, to generate data cleaned from and then deliver this data to their recipient or client on the network 11, directly or possibly after having subjected these data cleaned of other controls or manipulations. Thus, in the example where the data received at the input of the analysis module 6 corresponds to a Web page responding to the HTTP protocol and containing a script in JavaScript, the page can be cleaned of all or part of the malicious script, before transmission. to its destination on the network 11. This cleaning module 10 can, alternatively, permanently or temporarily block the data d, as represented by a cross circled at the end of Figure 1, at the output of the cleaning module 10, so that these data d are blocked before penetration on the network 11. Thus, in the example where the data received at the input of the analysis module 6 correspond to a Web page responding to the HTTP protocol and containing a script in JavaScript, the page can be blocked in a storage area without transmission to its recipient on the network 11. The recipient and / or an administrator of the network 11 may possibly be notified thereof. which allows them to check the data of the web page in question and possibly decide to delete or unblock it. FIG. 2 shows in greater detail an example of a normalization method (C) and a standardization computer system 8 according to the invention, as they are respectively integrated in the detection method and in the detection computer system according to the invention represented. schematically in FIG. 1. The standardization system comprises a transformation module (3) which receives as input, either directly the EO script identified and extracted respectively by the analysis and extracting modules 6 and 7 as explained hereinafter. above with reference to Figure 1, an EosimP script obtained after implementation of a preliminary lexical analysis step (Cl) by a lexical analysis module 4. This lexical analysis module 4 is connected to a base of lexical data 2 and allows, in particular, by comparing the lexical data of the input Eo script with the lexical data stored in the lexical database 4, to remove from this script Eo cer some useless data to form the simplified EosimP script. Thus, the transformation module 3 receives as input the initial script Eo or the simplified script after lexical analysis EosimP, and makes it possible to implement the step (C2) of transforming the normalization method (C) of the invention. For simplicity, in the remainder of the description, we will use the Eo denomination to refer indifferently to the un-simplified initial script Eo and the simplified script EosimP For the implementation of this transformation step (C2), the transformation module is connected to a database of transformations 1. This database of transformations 1 contains a series of n transformations Tn, with n> _ 1, which, when applied to a script, modifies this script without modifying the result of the transformation. execution of the script. In other words, these transformations Tn are such that the result of the execution of the transformed script is the same as the result of the execution of the unprocessed script. An example of such a transformation will be given below with reference to FIG.

Once the input script Eo transformed by the transformation module 3 during the step (C2) into the transformed script So, the latter can be transmitted to the evaluation module 9 for implementation of the step of evaluation (D), as explained above with reference to FIG.

However, preferably and only in the case where the transformed script So at the output of the transformation module 3 is not identical to the initial script Eo at the input of the transformation module 3, at the end of the first implementation of the transformation step (C2), this transformation step (C2) is implemented several more times, successively.

More precisely, the transformation step (C2) is implemented several more times, successively with the input of the transformation module 3 the script E; +1 corresponding to the transformed script Si obtained at the output of the transformation module 3 during the transformation. previous implementation of the transformation step (C2), with i> _ 1, until the output Si of the transformation module 3 is identical to the input E. In this case, it is the last transformed script If, at the output of the transformation module 3 at the end of the last implementation of the transformation step (C2), which is transmitted to the evaluation module 9 for implementing the step of evaluation (D), as explained above with reference to FIG. 1. FIG. 3 schematically represents one of the possible transformations Tn, capable of being stored in the database of transformations 1 and of being applied to a script by the transformation module 3 during the tape processing (C2).

More precisely, this FIG. 3 diagrammatically represents an example of application of such a transformation, aimed at reconcerting an attack masked by the bursting of an instruction into several strings of characters, in a JavaScript Eo script. Beforehand, as explained above with reference to FIG. 2, the Eo script undergoes a lexical analysis (Cl) making it possible to simplify it and to isolate elementary portions of the script that make up the simplified Eos'mp script, and which will then undergo the transformation Tn during step (C2) a first time and a second time. Thus Eos'mp is transformed into So = El itself transformed into Si. A last application of the transformation, not shown in Figure 3, with E2 = SI input generates a script S2 identical to SI, so that the transformation step is completed and that SI can be transmitted to the evaluation module 9 for implementation of the evaluation step (D). In the example of FIG. 3, the result of the evaluation step (D) shows that the signature SIGN of the standardized script SI corresponds to the signature of a malicious script.

It will be recalled that the step (C2) of the normalization process (C) consists in particular in applying one or more transformations Tn, and not necessarily a single transformation Tn. Moreover, it is possible to take advantage of the implementation of the normalization process (C) to collect statistics which will allow for example to evaluate an obfuscation rate and / or to generate other indicators of potential attacks. . The different steps of the normalization method and the detection method as presented above are implemented by one or more processors, remote or associated with the same computer unit.

Furthermore, the different databases used in the normalization process and the detection method as presented above are stored in one or more memory areas, remote or associated with the same computer unit. When referring to a database in the description above, it may be a single database or a combination of several databases, stored in the same memory area or in multiple memory areas distant or associated with the same computer unit.

Claims (14)

REVENDICATIONS1. Method (C) for normalizing a script-type program ([o) characterized in that it comprises a transformation step (C2) during which a series of n1 transformations (Tk) is executed a first time, with inputting the script (Eo, Eos'mp) and outputting a first transformed script (So), said transformations (Tk) being stored in a database of transformations (1) and not modifying the result of the execution of the script program. 2. Method according to claim 1, characterized in that, after the first execution of the transformation step (C2), and if the first transformed script (So) is different from the script (Eo, Eos'mp), said step of transformation (C2) is executed one or more times, with the transformed (S; 4) script obtained at the previous execution of said transform step (C2) at input (E;), until the script transformed into output (Si) is identical to the script transformed into input (E;). 3. Method according to any one of claims 1 and 2, characterized in that it comprises, prior to the transformation step (C2), a lexical analysis step (C1) during which the script data (Eo) are compared with lexical data stored in a lexical database (2) and unnecessary data are removed from said script (Eo) according to the comparison, to form a simplified script (Eos'mp), said step of transformation (C2) being executed the first time with as input said simplified script (Eos'mP) 4. Computer system for standardization (8) of a script-type program characterized in that it comprises a database of transformations (1) in which is stored a series of n> _1 transformations (Tk) that do not modify the result of the execution of the script, and a transformation module (3) adapted to apply said series of transformations (Tk) to the script ([o, EosimP) so as to generate a first transformed script (So). 5. System (8) according to claim 4, characterized in that the transformation module (3) is able to apply the series of transformations (Tk) one or more times, with the input (E;) the transformed script (S 4) obtained during the previous application of said series of transformations (Tk), until the script converted to output (Si) is identical to the transformed script input (E;). 6. System (8) according to any one of claims 4 and 5, characterized in that it comprises a lexical database (2) in which are stored lexical data, and a lexical analysis module (4) able to compare the data of the script (Eo) and the lexical data and to delete from said script (E0) the useless data according to said comparison, to form a simplified script (Eos'mP) 7. A method for detecting attacks on a computer network (11) comprising a step of analyzing (A) data (d) intended to circulate on said network (11) in order to identify a script-type program in said data (d), and an extraction step (B) of a script identified during said analysis step (A), characterized in that it further comprises a step (C) of implementing the method method according to any one of claims 1 to 3, applied to said extracted script during the extraction step (B). Method according to claim 7, characterized in that it comprises an evaluation step (D) in which the standardized script is compared with malicious script signatures and / or malicious code sequences stored in one or more several databases of signatures and / or malicious code sequences (5). 9. Method according to claim 8, characterized in that when the evaluation step (D) indicates that the standardized script corresponds to a malicious script signature and / or contains a malicious code sequence, a cleaning step (E ) is implemented in which all or part of the script identified during the extraction step (B) is removed from the data (d) analyzed during the analysis step (A) to form cleaned data (d '), before delivery of said cleaned data (d') to their recipient or client in the network (11). Method according to claim 8, characterized in that when the evaluation step (D) indicates that the normalized script corresponds to a malicious script signature and / or contains a malicious code sequence, a cleaning step (E) is implemented during which the data (d) analyzed during the analysis step (A) are blocked before penetration of said data (d) on the network (11). 11. Computer attack detection system on a computer network (11), comprising an analysis module (6) able to analyze the data (d) intended to circulate on said network (11) and to identify a program of type script in said data (d), and an extraction module (7) able to extract from said data (d) an identified script, characterized in that it further comprises a normalization computer system (8) according to one any of claims 4 to 6. System according to Claim 11, characterized in that it comprises at least one database of signatures and / or code sequences (5) in which malicious signatures and / or code sequences are stored, and a module evaluation tool (9) adapted to compare a standardized script with said malicious script signatures and / or malicious code sequences. 13. System according to claim 12, characterized in that it comprises a cleaning module (10) able to remove data (d) analyzed by the analysis module (6), all or part of a script of which the evaluation of the corresponding standardized script program by the evaluation module (9) indicates that it corresponds to a malicious script signature and / or contains a malicious code sequence, to form cleaned data (of), before delivery said cleaned data (d ') to their recipient or client on the network (11). 14. System according to claim 12, characterized in that it comprises a cleaning module (10) able to block the data (d) analyzed by the analysis module (6), when they contain a script whose evaluating the corresponding standardized script by the evaluation module (9) indicates that it corresponds to a malicious script signature and / or contains a malicious code sequence, before penetrating said data (d) onto the network (11).