Microsoft Research Develops Zozzle JavaScript Malware Detection Tool

Question

As browser-based exploits and specifically JavaScript malware have shouldered their way to the top of the list of threats, browser vendors have been scrambling to find effective defenses to protect users. Few have been forthcoming, but Microsoft Research has developed a new tool called Zozzle that can be deployed in the browser and can detect JavaScript-based malware at a very high effectiveness rate.Zozzle is designed to perform static analysis of JavaScript code on a given site and quickly determine whether the code is malicious and includes an exploit. In order to be effective, the tool must be trained to recognize the elements that are common to malicious JavaScript, and the researchers behind it stress that it works best on de-obfuscated code. In the paper, the researchers say that they trained Zozzle by crawling millions of Web sites and using a similar tool, called Nozzle, to process the URLs and see whether malware was present.Continued here:http://threatpost.com/en_us/blogs/microsoft-research-develops-zozzle-javascript-malware-detection-tool-120210

ky331 · Answer

Zozzle is not yet available:   'The new tool is still in the research phase and it's not clear when or if Microsoft Research might release Zozzle' Moreover, the above article links to a research paper which concedes 'the overhead of this runtime technique may be 10%or higher, which is too much overhead to be acceptable in today’s competitive browser market'. We'll see what happens, should Zozzle actually be released...

Bugbatter · Answer

Zozzle is not yet available:   'The new tool is still in the research phase and it's not clear when or if Microsoft Research might release Zozzle' Moreover, the above article links to a research paper which concedes 'the overhead of this runtime technique may be 10%or higher, which is too much overhead to be acceptable in today’s competitive browser market'. Those points are included in the article and research paper. Do you have a question, or are you restating for the public who may not choose to read the article?

ky331 · Answer

'restating for the public who may not choose to read the article' it's a very interesting idea...  i certainly would consider trying/testing it if available... and so was disappointed to find out it's just 'vaporware'.   I figured it was worthwhile to highlight this point at the outset, so as to minimize other people's expectations when they read the headline. Stories about vaporware are as exciting as stories about car engines that will get 100 mpg.    I'll take a closer look at each... when actually available.

bestis1980 · Answer

Its a great idea and i really looking for it but is it applicable for Firefox and Opera browsers too or only IE users can use it? If Microsoft release it only for IE users, many internet users can't benefit from it.

ky331 · Answer

Quoting from the research paper cited in the article http://research.microsoft.com/pubs/141930/tr.pdf

page 7, second column, Section III (Implementation), part A , third paragraph:

"Our experiments presented in this paper involved instrumenting the Internet Explorer browser, but we could have used a different browser such as Firefox or Chrome instead".

Virus & Spyware

Was this post helpful?