KR102001814B1 - A method and apparatus for detecting malicious scripts based on mobile device - Google Patents

Abstract

A malicious script detection method of a mobile terminal is provided. The detection method according to an embodiment of the present invention includes intercepting an HTTP request from a mobile browser, parsing the HTTP request, extracting a URL from the HTTP request, matching the extracted URL with a URL black list, Determining whether the extracted URL is a malicious URL, performing a URL redirection if the extracted URL is a malicious URL, and if the extracted URL is a normal URL as a result of the determination, Parsing the HTTP response to extract a script from the HTTP response, and if the extracted script is pattern-matched with a stored signature updated from an external signature management system, And determining by a script.

Description

[0001] METHOD AND APPARATUS FOR DETECTING MALICIOUS SCRIPTS BASED ON MOBILE DEVICE [0002]

The present invention relates to a method and apparatus for malicious script detection based on a mobile device. More particularly, the present invention relates to a mobile device-based malicious script detection method and apparatus capable of detecting malicious URLs and malicious scripts.

Malicious scripts are increasing in web-based Internet services, and new malicious scripts are constantly emerging. A malicious script is executed when a web page is rendered, damaging the network, and illegally acquiring information.

The methods of analyzing malicious scripts can be roughly divided into static analysis and dynamic analysis. Static analysis is a method of analyzing without executing malicious script, such as source code / binary pattern matching. Dynamic analysis is a method of executing and analyzing the above malicious script, for example, data flow and code flow analysis. Static analysis techniques have the advantage of being safe and quick to analyze because they exclude execution of malicious scripts.

Meanwhile, in order to increase the security level of mobile terminals such as smart phones, a method of detecting malicious scripts by a static analysis method is required in smart phones, but such technology is not yet provided.

Open Patent Publication No. 2007-0049511 (published May 11, 2007)

SUMMARY OF THE INVENTION The present invention provides a method and apparatus for detecting a malicious script through a static analysis method in a mobile terminal.

The technical problems of the present invention are not limited to the above-mentioned technical problems, and other technical problems which are not mentioned can be clearly understood by those skilled in the art from the following description.

The malicious script detection method of a mobile terminal according to an exemplary embodiment of the present invention includes intercepting an HTTP request from a mobile browser, parsing the HTTP request, extracting a URL from the HTTP request, Determining whether or not the extracted URL is a malicious URL by matching with the list, and if the extracted URL is a malicious URL, performing URL redirection as a result of the determination, and if the extracted URL is a normal URL Parsing the HTTP response to extract a script from the HTTP response, and if the extracted script is pattern-matched with the stored signature updated from the external signature management system, And judging the extracted script as a malicious script.

In one embodiment, the malicious script detection method may further include a step of, when the malicious script is for unauthorized removal of data measured by a sensor provided in the mobile terminal, And removing the portion from the mobile browser and providing the portion to the mobile browser.

In one embodiment, in the case where the malicious script is to operate the light output device, the sound output device, or the vibration output device provided in the mobile terminal without user's operation, the malicious script detection method may include: And removing the portion for execution of the malicious script from the web document and providing the portion to the mobile browser.

In one embodiment, the malicious script detection method further includes transmitting data indicating a new malicious script pattern matching fact to the signature management system when the signature of the new malicious script according to the update matches the pattern of the analysis target script As shown in FIG.

In one embodiment, the malicious script detection method may further include: when the signature management system receives data indicating a fact of matching the new malicious script pattern over a predetermined number of times, detecting a malicious script so that the latest signature can be forcibly updated And transmitting an update control signal to all the mobile terminals in which the software is installed.

In one embodiment, extracting the script from the HTTP response comprises:

Further comprising the steps of: determining whether obfuscation has been performed on the extracted script; and canceling the obfuscation if the obfuscation is made as a result of the determination, wherein the step of determining the extracted script as a malicious script comprises: And determining that the extracted script is a malicious script if the released script is pattern-matched with the stored signature updated from the external signature management system.

In one embodiment, the malicious script detection method further comprises: performing a URL redirection to prevent execution of the malicious script when the extracted script is a malicious script as a result of determining whether or not the malicious script is the malicious script; And transmitting the HTTP response packet to the client when the HTTP response packet is not a script.

According to another embodiment of the present invention, a mobile terminal performing a malicious script detection method is provided. The mobile terminal comprises a processor, a memory for loading malicious script corresponding operations to be executed in the processor, and malicious script detection software and mobile browser malicious scripts and general malicious scripts that are loaded into the memory and constitute the malicious script corresponding operation Lt; RTI ID = 0.0 > a < / RTI > The malicious script corresponding operation may include an operation of intercepting an HTTP request from a mobile browser, parsing the HTTP request, extracting a URL from the HTTP request, matching the extracted URL with a URL black list, And if the extracted URL is a malicious URL, performs a URL redirection. If the extracted URL is a normal URL, an HTTP response is received from an external server And parsing the HTTP response to extract a script from the HTTP response. If the extracted script is pattern-matched with a signature that is updated and stored from an external signature management system, the extracted script is judged to be a malicious script And a malicious software If the bit is a mobile browser malicious scripts, it includes the operations provided in the mobile browser by removing the portion for the execution of the malicious script in the web page of the HTTP response.

In one embodiment, when the malicious script is a general malicious script, the malicious script corresponding operation adds a tag for causing a portion for executing the malicious script to be directly displayed on the screen to the web document of the HTTP response , And providing the mobile browser with the operation.

According to some embodiments of the present invention, it is possible to enhance security for a mobile terminal, such as detecting a malicious script specific to a mobile terminal in a mobile terminal.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned can be clearly understood to those of ordinary skill in the art from the following description.

1 is a block diagram of a malicious script detection system according to an embodiment of the present invention.
2 is a hardware block diagram of a malicious script detection apparatus according to another embodiment of the present invention.
Figure 3 is a flowchart of the operations performed by the acquisition / processing module, referred to in some embodiments of the present invention.
4 is a flowchart of the operations performed by the analysis module referred to in some embodiments of the present invention.
5 is a flowchart of a malicious URL checking method, which is referenced in some embodiments of the present invention.
Figure 6 is a flowchart of a malicious script checking method, which is referenced in some embodiments of the present invention.
7 is a block diagram of a malicious script detection apparatus according to another embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention and the manner of achieving them will become apparent with reference to the embodiments described in detail below with reference to the accompanying drawings. The present invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Is provided to fully convey the scope of the invention to those skilled in the art, and the invention is only defined by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense commonly understood by one of ordinary skill in the art to which this invention belongs. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise. The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification.

It is noted that the terms "comprises" and / or "comprising" used in the specification are intended to be inclusive in a manner similar to the components, steps, operations, and / Or additions. Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1 is a block diagram of a malicious script detection system according to an embodiment of the present invention.

The malicious script detection system according to the present embodiment may include a malicious script detection apparatus 100, an external server 50, and a mobile terminal 70. The external server 50 is a server that provides services to the mobile terminal 70 based on a server-client model, for example, a web server. The malicious script detection apparatus 100 recognizes data corresponding to a malicious script among data transmitted from the external server 50 to the mobile terminal 70 and generates appropriate notification data corresponding to the data to transmit to the mobile terminal 70 .

The malicious script detection apparatus 100 may collect packets transmitted and received by the mobile browser of the mobile terminal 70 and the external server 50 and may analyze whether malicious URLs or malicious scripts are present and perform post processing .

The malicious script detection apparatus 100 may include a collection / processing module and an analysis module. The collection / processing module may be implemented in the form of a proxy server, collects URL information from the packet requested by the mobile browser of the mobile terminal 70, checks the packet received from the web server and extracts the script . In addition, if the analysis result is received from the analysis module, the URL redirection processing can be performed in order to prevent the URL access and the execution of the script in case of maliciousness.

The analysis module may perform a function of determining whether the URL or the script received from the collection / processing module is malicious through matching with a URL black list and a signature. In addition, if the received script is obfuscated, the analysis module can perform an obfuscation function to extract the plaintext script from the obfuscated malicious script.

The malicious script detection system according to another embodiment of the present invention may be composed of only the mobile terminal 70 and the external server 50, unlike the one shown in FIG. At this time, the mobile terminal 70 may be installed with malicious script detection software in which methods according to some embodiments of the present invention are implemented. The malicious script detection software recognizes data corresponding to a malicious script among data transmitted from the external server 50 to the mobile terminal 70, and generates appropriate notification data accordingly. The malicious script detection software may be installed at the time of manufacturing the mobile terminal 70 or may be installed after the user purchases the app market through the app market.

In some embodiments, the malicious script detection software is implemented in the form of a local proxy. The local proxy refers to a tool capable of receiving a service request / response transmitted and received between a server and a client in between. The service request / response may be, for example, an HTTP request / response.

Hereinafter, the operation and configuration of the mobile terminal 70 will be described with reference to FIG. 2 is a hardware configuration diagram of the mobile terminal 70 according to the present embodiment.

2, a mobile terminal 70 may include one or more processors 110, a memory 120, a storage 140, and an interface 130. The processor 110, the memory 120, the storage 140, and the interface 130 transmit and receive data through the system bus. The interface 130 is connected to a network such as the Internet by a wireless communication scheme.

The processor 110 executes the malicious script detection software 142 loaded into the memory 120 and the memory 120 loads the malicious script detection software 142 from the storage 160. [ Malicious script detection software 142 may include a collection / processing operation 122, an analysis operation 124,

Malicious script detection software 142 is implemented as a local proxy. Accordingly, the malicious script detection software 142 may intercept the HTTP request generated by the mobile web browser application, and may intercept the HTTP response to be transmitted to the mobile web browser application. 2 illustrates a situation in which the acquisition / processing operation 122 and the analysis operation 124 are stored in the memory 120 as a result of the malicious script detection software 142 being loaded into the memory 120. [

When the HTTP request is intercepted, the collection / processing operation 122 extracts the URL from the HTTP request and transmits an analysis request for the URL to the analysis operation 124. If the analysis operation 124 provides data on whether or not the URL is normal as an answer to the analysis request, it processes the intercepted HTTP request accordingly. For example, if the URL is OK, the collection / processing operation 122 normally sends the intercepted HTTP request to the external server. In addition, if the URL is abnormal, the collection / processing operation 122 may discard the intercepted HTTP request to the web server and generate a notification message for the discard processing.

The collection / processing operation 122 also intercepts the HTTP response from the external server. The acquisition / processing operation 122 extracts the analysis target script from the intercepted HTTP response, and transmits an analysis request for the analysis target script to the analysis operation 124. If the script is a malicious script, The web document included in the HTTP response can be modified so that execution is prevented. At this time, the collection / processing operation 122 removes, for example, a portion for executing the malicious script of the web document, or adds a tag for causing the portion for executing the malicious script to be directly displayed on the screen . The tag for causing the portion for executing the malicious script to be directly displayed on the screen may be, for example, an XMP tag or a PRE tag.

In one embodiment, the gather / process operation 122 may provide the mobile browser with a redirection page instead of a web document containing the malicious script, so that execution of the malicious script is prevented. As a result, the mobile browser will display the redirection page to guide malicious script detection.

In one embodiment, the gather / process operation 122 may correspond to the case where the malicious script is a mobile browser malicious script and the case where it is a general script. For example, if the malicious script is a mobile browser malicious script, the collection / processing operation 122 may remove the portion for execution of the malicious script from the web document of the HTTP response and provide it to the mobile browser. In addition, if the malicious script is a general malicious script, the collection / processing operation 122 adds a tag to the web document of the HTTP response so that the portion for executing the malicious script is directly displayed on the screen, It can be provided to a mobile browser.

Upon receiving the analysis request for the URL from the collection / processing operation 122, the analysis operation 124 determines whether the URL is a malicious URL by matching the URL with the URL black list 144, To the processing operation 122.

When the analysis operation 124 receives an analysis request for a script from the collection / processing operation 122, the analysis operation 124 determines whether the script is a malicious script by pattern-matching the script with the signature 146, / Processing operation 122, as shown in FIG. The pattern matching may be performed based on Yara-Rules. For information about Yara-Rule, see the web document 'https://github.com/Yara-Rules/rules'.

In some embodiments, the analysis operation 124 may be an interfacing interface with an external system that performs analysis on the script. In this case, the collection / processing operation 122 may utilize the script analysis service of the external system using the interface.

In some embodiments, the analysis operation 124 may be an interfacing interface with an external behavior analysis system that performs behavior analysis on the web page to be analyzed. In this case, the collection / processing operation 122 reflects the behavior analysis result on the web page indicated by the URL of the HTTP request to the external system using the interface, and determines whether to forward the HTTP request to the external server normally You can decide. The analysis operation 124 may interact with the behavior analysis system via the RESTful API.

In some other embodiments, analysis operation 124 may be associated with a signature management system that updates the signatures of mobile browser malicious scripts in real time, and may update updated signatures from the signature management system and store them in storage 140. At this time, the analysis operation 124 may detect the latest malicious script specialized for mobile using the signature of the mobile browser malicious script updated in real time, and may block execution of the malicious script. The signature update may be performed periodically or aperiodically. The analysis operation 124 may interact with the signature management system via the RESTful API.

The signature management system can manage signatures of common malicious scripts as well as mobile browser malicious scripts. At this time, the signature may be distinguished from the mobile browser malicious script and the general malicious script.

In some embodiments, when the signature of the new malicious script added by the update and the pattern matching of the script to be analyzed become the analysis operation 124, data indicating the new malicious script pattern matching fact in the signature management system Can be transmitted. The signature management system transmits an update control signal to all the mobile terminals installed with the malicious script detection software so that the latest signature can be forcibly updated when the data indicating the new malicious script pattern matching fact is received a predetermined number of times or more .

The storage 140 may include malicious script detection software 142, a URL blacklist 144, a signature 146, and a detection log 148.

The URL blacklist 144 may include malicious URL information, the signature 146 may include malicious script information, and the detection log 148 may include a detection record of a malicious URL and a malicious script.

The malicious script specific to the mobile terminal may be, for example, a script for performing specific logic referring to the positioning information of the mobile terminal, or a script for transmitting the positioning information of the mobile terminal to a destination determined unauthorized by the user of the mobile terminal Or a script for causing continuous vibration of the mobile terminal, a script for turning on the flash of the mobile terminal, or a variety of sensors installed on the mobile terminal such as a camera or a microphone, and transmits the sensed data to the user of the mobile terminal Or a script to send to an unauthorized destination without permission of the user. The malicious script specific to the mobile terminal does not affect other functions of the web document even if the script is not executed. That is, the malicious script is for unauthorized removal of the data measured by the sensor provided in the mobile terminal, or that the light output device, the sound output device, or the vibration output device provided in the mobile terminal is operated without user's operation If so, the collection / processing operation 122 may remove the portion for execution of the malicious script specific to the mobile terminal from the web document and provide it to the web browser of the mobile terminal.

Each component in FIG. 2 may refer to software or hardware such as an FPGA (Field Programmable Gate Array) or an ASIC (Application-Specific Integrated Circuit). However, the components are not limited to software or hardware, and may be configured to be addressable storage media, and configured to execute one or more processors. The functions provided in the components may be implemented by a more detailed component, or may be implemented by a single component that performs a specific function by combining a plurality of components.

Figure 3 is a flowchart of the operations performed by the acquisition / processing module, referred to in some embodiments of the present invention.

When an HTTP request packet for requesting a web page is generated from the mobile browser of the mobile terminal (S100), the proxy acquisition / processing module may collect the HTTP request packet and extract the URL from the corresponding request packet (S110). The collection / processing module can parse the collected packets and extract URLs.

The collection / processing module transmits the extracted URL information to the analysis module to request the analysis (S130). The analysis module checks whether the corresponding URL information is normal or malicious, and transmits the analysis result to the collection / processing module The collection / processing module checks the analysis result to determine whether it is malicious (S180), and performs the post-processing according to the determination result.

If the analysis result is malicious, the collecting / processing module can check the redirection URL from the source field to perform URL redirection (S190). If the analysis result is normal, the HTTP relay is performed (S140) (S150), and extracts the script information from the response packet (S160).

The acquisition processing module transmits the extracted script information to the analysis module to request the script analysis (S130). The analysis module determines whether the script information is normal or malicious, and transmits the analysis result to the collection / processing module The collection / processing module checks the analysis result to determine whether it is malicious (S180), and performs the post-processing according to the determination result. The collection / processing module can be applied to the web browser after the post-processing to resume loading.

4 is a flowchart of the operations performed by the analysis module referred to in some embodiments of the present invention. The analysis module can determine whether the URL and script are malicious.

When the analysis module receives the analysis request message for the URL from the collection / processing module (S200), it can check whether the analysis target URL is a malicious URL (S205). In step S205, the analysis module compares the URL with the URL stored in the URL Black List, and may determine that the malicious URL exists if a matching URL exists. The reason for detecting malicious URLs first is to quickly detect malicious resources through malicious URL scans before script analysis.

The analysis module may perform post-processing according to the analysis result (S500). In step S500, if the analysis module determines that the URL is a malicious URL, the analysis module may store the analysis result for the URL, and may store the result in the detection log, for example. You can also perform URL redirection for that URL.

When the analysis module receives the analysis request message for the script from the collection / processing module (S300), it can analyze whether the script is a malicious script (S305).

In step S305, if the signature of the malicious script specific to the mobile terminal and the script are pattern-matched, the analysis module can determine the script as a malicious script. As such, static analysis is performed with reference to the signature in step S305. The signature may be updated through interworking with a signature management system external to the mobile terminal.

Signatures are pattern information used to detect malicious scripts, and they include pattern information of malicious scripts found in the past. Signatures can be stored separately in the signature database. Using pre-stored signatures, malicious scripts can be scanned as quickly as possible.

Meanwhile, the analysis module can determine whether the analysis target script is obfuscated (S400). If it is determined that the analysis target script is obfuscated, the analysis module can perform the obfuscation analysis (S405).

In step S405, the analysis module can distinguish the types of obfuscation techniques and perform the obfuscation release according to the distinguished obfuscation technique to extract the plaintext script. The analysis module can compare the extracted plaintext script with the script stored in the malicious script signature to determine whether it is a malicious script.

The analysis module may perform post-processing of the analysis result of the script (S500). In step S500, if the script is a malicious script, analysis result information can be stored. For example, the analysis results can be stored in the detection log. You can also run URL redirection. The detection log may contain malicious URL information, malicious script information, and obfuscation script information.

If the script is not a malicious script, the original session information may be transmitted to the collection / processing module without any further processing.

5 is a flowchart of a malicious URL checking method, which is referenced in some embodiments of the present invention.

The analysis module may receive an analysis request message for the URL from the collection / processing module (S200). The analysis module can perform matching with the URL information stored in the URL Black List DB and the analysis target URL (S210).

As a result of the matching, if the analysis target URL is a malicious URL, the detection information including the URL, the detection time, and the like may be stored in the detection log DB (S230). As a result, the result information can be continuously updated to enhance the security effect.

As a result of the matching, if the analysis target URL is not a malicious URL, the URL analysis may be terminated without further processing (S240).

Figure 6 is a flowchart of a malicious script checking method, which is referenced in some embodiments of the present invention.

The analysis module may receive an analysis request message for the script from the collection / processing module (S300). The analysis module can perform pattern matching between the target script and the malicious script information stored in the signature DB (S310).

In step S310, when the analysis module receives the analysis request message, it can determine whether the target script is obfuscated. For example, the analysis module can determine whether to obfuscate by comparing the hash values before and after execution of the script. If the target script is obfuscated, the analysis module can perform de-obfuscation and extract plaintext scripts. The extracted plaintext script is matched with the malicious script information stored in the signature DB.

In step S320, if the pattern matching is successful as a result of the pattern matching, the analysis module can determine the script as a malicious script. If the target script is malicious, detection information including the script, URL, detection time, etc. can be stored in the detection log DB. Further, the URL redirection for the malicious script can be performed (S330). The analysis module can perform the execution prevention processing by performing the URL redirection.

In step S320, if the analysis module fails to match the pattern matching result, it can determine that the script is not a malicious script but a normal script. If the analysis module is not malicious, the script analysis can be terminated without further processing.

7 is a block diagram of a malicious script detection apparatus according to another embodiment of the present invention.

The malicious script detection apparatus 100 may include a communication unit 200, a collection / processing unit 220, an analysis unit 240, and a storage unit 260. The malicious script detection apparatus 100 can transmit and receive packets to and from an external server and a client through the communication unit 200. [

The collection / processing unit 220 may collect packets, extract URLs and scripts therefrom, and perform post processing according to whether the malicious packets are malicious or not. The analyzer 240 can determine whether the URL and the script are malicious. The storage unit 260 may store malicious URLs and malicious script information.

Additionally, the malicious script detection apparatus 100 may notify the user of the detection information, and may include a user GUI function for supporting the detection setting.

For example, the user can turn on / off the web access URL checking function, turn on / off the script static analysis function, and turn on / off the obfuscation checking function through the user GUI function. The user can also request a signature update.

In addition, the user can reserve or manually set the signature update setting through the user GUI function, and the URL blacklist update setting can be scheduled or manually. Also, it is possible to set whether or not to display the real-time detection notification window, and to set whether to transmit detection log information.

Through the user GUI function, the user can view the total detection rate by types of malicious script and malicious URL detection, and view the detection status by malicious script and malicious URL detection period. In addition, malicious script and malicious URL detection can be searched by period and content.

The methods according to the embodiments of the present invention described so far can be performed by execution of a program implemented with a code readable by a computing device. The program may be transmitted from a first computing device to a second computing device via a network, such as the Internet, and installed in the second computing device, thereby enabling it to be used in the second computing device. The first computing device and the second computing device all include a server device, a physical server belonging to a server pool for cloud services, and a fixed computing device such as a desktop PC. The program may also be applied to a vaccine application of a mobile terminal.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

Claims (9)

Intercepting an HTTP request from a mobile browser;
Parsing the HTTP request and extracting a URL from the HTTP request;
Determining whether the extracted URL is a malicious URL by matching the extracted URL with a URL black list;
The mobile terminal performs URL redirection when the extracted URL is a malicious URL as a result of the determination and receiving an HTTP response from an external server when the extracted URL is a normal URL as a result of the determination;
Parsing the HTTP response and extracting a script from the HTTP response;
Determining that the extracted script is a malicious script if the extracted script is pattern-matched with a stored signature updated from an external signature management system,
The signature is for identifying mobile browser malicious scripts,
Wherein the step of determining the malicious script includes a step of determining whether the extracted script is obfuscated by comparing a hash value before execution of the extracted script with a hash value after execution of the extracted script,
How to detect malicious scripts. The method according to claim 1,
The mobile terminal removes a portion for execution of the malicious script from the web document of the HTTP response when the malicious script is for unauthorized removal of data measured by a sensor provided in the mobile terminal, To the first node,
How to detect malicious scripts. The method according to claim 1,
When the malicious script operates the light output device, the sound output device, or the vibration output device provided in the mobile terminal without user's operation, the malicious script in the web document of the HTTP response And removing the portion for execution and providing the portion to the mobile browser.
How to detect malicious scripts. The method according to claim 1,
Transmitting data indicating a new malicious script pattern matching fact to the signature management system when the mobile terminal becomes a new malicious script signature and a pattern matching of the analysis target script according to the update;
The signature management system transmits an update control signal to all mobile terminals installed with the malicious script detection software so that the latest signature can be forcibly updated when the data indicating the fact of matching the new malicious script pattern is received a predetermined number of times or more ≪ / RTI >
How to detect malicious scripts. The method according to claim 1,
The step of extracting the script from the HTTP response comprises:
Determining whether obfuscation has been performed on the extracted script; And
Further comprising the step of canceling the obfuscation if obfuscation is made as a result of the determination,
The step of determining the extracted script as a malicious script includes:
Judging the extracted script as a malicious script if the script whose obfuscation is released is updated from the signature management system of the external and is pattern-matched with the stored signature,
How to detect malicious scripts. The method according to claim 1,
If the extracted script is a malicious script as a result of determining whether or not the script is malicious, execution of the URL redirection is prevented to prevent execution of the malicious script. If the extracted script is not a malicious script, an HTTP response packet is transmitted to the client ≪ / RTI >
How to detect malicious scripts. A computer program stored on a storage medium for executing the method of any one of claims 1 to 6 using a computer. A processor;
A memory for loading a malicious script corresponding operation to be executed in the processor; And
Malicious script detection software loaded into the memory and constituting the malicious script corresponding operation, and storage for storing signatures including data for identifying mobile browser malicious script and general malicious script,
The malicious script corresponding operation includes:
Intercepting an HTTP request from a mobile browser, parsing the HTTP request, and extracting a URL from the HTTP request;
An operation of determining whether the extracted URL is a malicious URL by matching the extracted URL with a URL black list;
Performing a URL redirection if the extracted URL is a malicious URL as a result of the determination; and receiving an HTTP response from an external server when the extracted URL is a normal URL as a result of the determination;
Parsing the HTTP response and extracting a script from the HTTP response;
Determining that the extracted script is a malicious script if the extracted script is pattern-matched with a stored signature updated from an external signature management system; And
And removing the portion for execution of the malicious script from the web document of the HTTP response if the malicious script is a malicious script of the mobile browser and providing the malicious script to the mobile browser,
Wherein the malicious script determining operation includes an operation of determining whether the extracted script is obfuscated by comparing a hash value before executing the extracted script with a hash value after executing the extracted script,
Mobile terminal. 9. The method of claim 8,
The malicious script corresponding operation includes:
Adding a tag for causing the web document of the HTTP response to be displayed on the screen to directly execute the malicious script when the malicious script is a general malicious script and then providing the malicious script to the mobile browser ,
Mobile terminal.

Images