JStrack: Enriching Malicious JavaScript Detection Based on AST Graph Analysis and Attention Mechanism

Abstract

Malicious JavaScript is one of the most common tools for attackers to exploit the vulnerability of web applications. It can carry potential risks such as spreading malware, phishing, or collecting sensitive information. Though there are numerous types of malicious JavaScript that are difficult to detect, generalizing the malicious script's signature can help catch more complex JavaScripts that use obfuscation techniques. This paper aims at detecting malicious JavaScripts based on structure and attribute analysis of abstract syntax trees (ASTs) that capture the generalized semantic meaning of the source code. We apply a graph convolutional neural network (GCN) to process the AST features and get a graph representation via neural message passing with neighborhood aggregation. The attention layer enriches our method to track pertinent parts of scripts that may contain the signature of malicious intent. We comprehensively evaluate the performance of our proposed approach on a real-world dataset to detect malicious websites. The proposed method demonstrates promising performance in terms of detection accuracy and robustness against obfuscated samples.

Detecting Malicious JavaScript Using Structure-Based Analysis of Graph Representation

“…However, considering graph representation as a sequence is limited in that it loses the structural information of the graph feature, which is an important piece of information to capture from source code graph representations. On the other hand, Rozi et al [34] proposed a structural analysis of the AST feature by using GNN combined with the attention layer to enrich the detection to track the rough location of malicious code based on given the attention score. In that work, they tried to focus on how to track the maliciousness part, which has a different objective than our work.…”

“…Furthermore, the use of a graph-based approach for JavaScript representation not only can be used for detecting the maliciousness of the source code, but it also can be a supporting feature for detecting malicious webpages [42] or websites [43].…”