Analysis and Identification of Malicious JavaScript Code

Abstract

Malicious JavaScript code has been actively and recently utilized as a vehicle for Web-based security attacks. By exploiting vulnerabilities such as cross-site scripting (XSS), attackers are able to spread worms, conduct Phishing attacks, and do Web page redirection to "typically" porn Web sites. These attacks can be preemptively prevented if the malicious code is detected before executing. Based on the fact that a malignant code will exhibit certain features, we propose a novel classification-based detection approach that will identify Web pages containing infected code. Using datasets of trusted and malicious Web sites, we analyze the behavior and properties of JavaScript code to point out its key features. These features form the basis of our identification system and are used to properly train the various classifiers on malicious and benign data. Performance evaluation results show that our approach achieves a 95% or higher detection accuracy, with very small (less than 3%) false positive and false negative ratios. Our solution surpasses the performance of the comparable literature.

Defending Malicious Script Attacks Using Machine Learning Classifiers

“…Keeping in view the impact that an attack can cause on the client side, detection of JavaScript at a real time thus became necessary. Several approaches have been proposed for classification and detection of malicious JavaScript code from the benign code of a website such as those of Rieck et al [5], Curtsinger et al [6], and Fraiwan et al [7], the problem of these approaches is time overhead in detection. Other approaches such as GATEKEEPER [8] and Google Caga [9] use a method of executing random JavaScripts from the code in a protected environment but can detect the limited type of attacks.…”

A deep learning approach for detecting malicious JavaScript code

“…(6) The Background Script displays the result to the user. (7) Extending our approach in order to detect malware written in other programming languages, such as VBScript, Java, C, and C++. Because there is no need for us to manually craft features, the work flow for detecting malicious code written in other languages would be similar with that in our paper.…”

“…Many researches concerned about the particular attack types, such as drive-by downloads [2,12] and heap spraying [13], relied on recognizing specific attacks. In addition to these methods, some tools have been developed for analyzing JavaScript code [7][8][9]14]. Although these approaches are effective and reduce the threat of attacks to a certain degree, they can hardly detect the evolving JavaScript attacks and often consume a large amount of time analyzing JavaScript code.…”

“…In Equations (1) and (2), we set s to be the sigmoid function as an activation function in both the encoding and decoding processes, and it takes the form s x ð Þ¼ 1 1þe Àx (7) and its first-order derivative is given by…”

“…As such, the detection of malicious JavaScript has received the attention of security researchers. Subsequently, several machine learning-based approaches have been put forward that automatically distinguish between malicious and benign activity, such as the detection frameworks in the works of Likarish et al [6] and Fraiwan et al [7] as well as the detectors in the works of Curtsinger et al [8] and Rieck et al [9]. Although the techniques can be applied to JavaScript detection, it requires much time and manpower to manually craft features for both malicious and benign JavaScript code.…”