Use JS-IN-JS interpreter trap execution to capture malicious Web site scripts

Main ideas:

(1) Using JS to implement a JS interpreter

Of course, there doesn't seem to be an open source library implementation yet? Esprima can be useful to translate the JS code into AST. (and the Google V8 engine was originally designed to be compiled from the AST to native machine code, perhaps can learn)

(2) For non-dom/idl access operation, can use the technology of compiling execution, but need to provide proxy trampoline interface;

(3) For the DOM tree operation or Web IDL (HTML API) access, equivalent to support the JIT language native unsafe extension, "virtual" execution, that is, actually do not really execute, but log the context of this call with logs;

However, the problem is that the original web site script may rely on the interfaces returned by these operations to perform further operations, in which case you can use:

(4) Virtual DOM tree Snapshot technology

That is, instead of modifying the true DOM tree, use JS to simulate a immutable version of the false DOM tree. Because the Web site script is executed by the interpreter model, in principle it is possible for the Web site script to assume that it is executing in the real world

(5) So we implemented a honeypot that captures malicious web script ...

Technical implementation difficulties: ...

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

Use JS-IN-JS interpreter trap execution to capture malicious Web site scripts