ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Abstract

Malicious scripts are an important computer infection threat vector in the wild. For web-scale processing, static analysis offers substantial computing efficiencies. We propose the ScriptNet system for neural malicious JavaScript detection which is based on static analysis. We use the Convoluted Partitioning of Long Sequences (CPoLS) model, which processes Javascript files as byte sequences. Lower layers capture the sequential nature of these byte sequences while higher layers classify the resulting embedding as malicious or benign. Unlike previously proposed solutions, our model variants are trained in an end-to-end fashion allowing discriminative training even for the sequential processing layers. Evaluating this model on a large corpus of 212,408 JavaScript files indicates that the best performing CPoLS model offers a 97.20% true positive rate (TPR) for the first 60K byte subsequence at a false positive rate (FPR) of 0.50%. The best performing CPoLS model significantly outperform several baseline models.

Taylor–HHO algorithm: A hybrid optimization algorithm with deep long short‐term for malicious JavaScript detection

“…Finally, the fused features are taken as an input on Deep LSTM, wherein the training of Deep LSTM is done in an optimal manner considering the proposed Taylor–HHO algorithm. The developed Taylor–HHO is devised by combining the Taylor series 17 and the HHO algorithm 18 . Finally, the output of the proposed Taylor–HHO‐based Deep LSTM is categorized into two classes, namely, normal JavaScriptcode and malicious JavaScript code.…”

“…Stokes et al 17 devised a ScriptNet system for neural malicious JavaScript detection using static analysis. The method utilized the Convoluted Partitioning of Long Sequences (CPoLS) model that processed the JavaScript files as the sequences of bytes.…”

“…The discovery of malicious JavaScript is imperative for preserving the user credentials in opposition to malware attacks 3 . Due to the ability of automatic running on whole operating models, the malevolent JavaScripts are ill‐treated by attackers for infecting users and mobiles 4 …”

“…With a functional viewpoint, JavaScript provides the design of interfaces with sophisticated operations. With defense viewpoint, the JavaScript represents strong language, which is extensively employed by cyber‐criminals for developing the malicious exploits 4 . In contrast to other kinds of network attacks, the malicious JavaScript code is predominantly complex to discover in the webpages.…”

Optimizing Away JavaScript Obfuscation

“…To this end, existing work on JavaScript (de)obfuscation has mostly focused on detecting (and preventing) malicious JavaScript, often using machine learning [11,[20][21][22][23] or program analysis [7] techniques. Machine learning approaches (e.g., random forests, support vector machines) have been shown to be effective when combined with semantic features (e.g., control flow and program dependency graphs, as used by JSTAP [22]).…”