检索结果-内蒙古大学图书馆

53rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

作者： Ren, Kunlun Qiang, Weizhong Wu, Yueming Zhou, Yi Zou, Deqing Jin, Hai Huazhong Univ Sci & Technol Natl Engn Res Ctr Big Data Technol & Syst Hubei Engn Res Ctr Big Data Secur Sch Cyber Sci & EngnServ Comp Technol & Syst Lab Wuhan 430074 Peoples R China Huazhong Univ Sci & Technol Cluster & Grid Comp Lab Natl Engn Res Ctr Big Data Technol & Syst Sch Comp Sci & TechnolServ Comp Technolo & Syst Wuhan 430074 Peoples R China Nanyang Technol Univ Singapore Singapore Jinyinhu Lab Wuhan Peoples R China

ISBN: (纸本)9798350347937

Due to the convenience and popularity of Web applications, they have become a prime target for attackers. As the main programming language for Web applications, many methods have been proposed for detecting malicious javascript, among which static analysis-based methods play an important role because of their high effectiveness and efficiency. However, obfuscation techniques are commonly used in javascript, which makes the features extracted by static analysis contain many useless and disguised features, leading to many false positives and false negatives in detection results. In this paper, we propose a novel method to find out the essential features related to the semantics of javascript code. Specifically, we develop JSRevealer, a robust, effective, scalable, and interpretable detector for malicious javascript. To test the capabilities of JSRevealer, we conduct comparative experiments with four other state-of-the-art malicious javascript detection tools. The experimental results show that JSRevealer has an average F1 of 84.8% on the data obfuscated by different obfuscators, which is 21.6%, 22.3%, 18.7%, and 22.9% higher than the tools CUJO, ZOZZLE, JAST, and JSTAP, respectively. Moreover, the detection results of JSRevealer can be interpreted, which can provide meaningful insights for further security research.

关键词： Web Security javascript obfuscation Malicious javascript Robustness

来源：评论

学校读者我要写书评

暂无评论

An Empirical Study on the Effects of obfuscation on Static Machine Learning-Based Malicious javascript Detectors 2023

An Empirical Study on the Effects of Obfuscation on Static M...

引用

32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA)

作者： Ren, Kunlun Qiang, Weizhong Wu, Yueming Zhou, Yi Zou, Deqing Jin, Hai Huazhong Univ Sci & Technol Natl Engn Res Ctr Big Data Technol & Syst Serv Comp Technol & Syst Lab Hubei Engn Res Ctr Big Data SecurSch Cyber Sci & Wuhan 430074 Peoples R China Nanyang Technol Univ Singapore Singapore Huazhong Univ Sci & Technol Natl Engn Res Ctr Big Data Technol & Syst Serv Comp Technol & Syst Lab Cluster & Grid Comp LabSch Comp Sci & Technol Wuhan 430074 Peoples R China Jinyinhu Lab Wuhan Peoples R China

ISBN: (纸本)9798400702211

Machine learning is increasingly being applied to malicious javascript detection in response to the growing number of Web attacks and the attendant costly manual identification. In practice, to hide their malicious behaviors or protect intellectual copyrights, both malicious and benign scripts tend to obfuscate their own code before uploading. While obfuscation is beneficial, it also introduces some additional code features (e.g., dead code) into the code. When machine learning is employed to learn a malicious javascript detector, these additional features can affect the model to make it less effective. However, there is still a lack of clear understanding of how robust existing machine learning-based detectors are on different obfuscators. In this paper, we conduct the first empirical study to figure out how obfuscation affects machine learning detectors based on static features. Through the results, we observe several findings: 1) obfuscation has a significant impact on the effectiveness of detectors, causing an increase both in false negative rate (FNR) and false positive rate (FPR), and the bias of obfuscation in the training set induces detectors to detect obfuscation rather than malicious behaviors. 2) The common measures such as improving the quality of the training set by adding relevant obfuscated samples and leveraging state-of-the-art deep learning models can not work well. 3) The root cause of obfuscation effects on these detectors is that feature spaces they use can only reflect shallow differences in code, not about the nature of benign and malicious, which can be easily affected by the differences brought by obfuscation. 4) obfuscation has a similar effect on realistic detectors in VirusTotal, indicating that this is a common real-world problem.

关键词： web security javascript obfuscation machine learning malicious javascript detector

来源：评论

学校读者我要写书评

暂无评论

On improvements of robustness of obfuscated javascript code detection

引用

JOURNAL OF COMPUTER VIROLOGY AND HACKING TECHNIQUES 2023年第3期19卷 387-398页

作者： Ponomarenko, G. S. Klyucharev, P. G. Bauman Moscow State Tech Univ Moscow Russia

This paper is dedicated to the problem of design of the detector for obfuscated javascript code using machine learning technologies. The main challenge was to design models that would be robust against obfuscators that the model got not familiar with during the training process. During the research we were trying to simulate the scenario when the obfuscation detector, trained to detect samples obfuscated by the specific obfuscators, is given samples that were processed by some another obfuscator. The presented approach of the feature engineering and model training allowed to get better accuracy on the previously unseen obfuscators comparing to the reference work. It was shown that treating minified code samples as obfuscated, as well as enriching the set of the lexical and syntactical features could improve detector's quality.

关键词： obfuscation detection obfuscator model classification javascript obfuscation javascript minification machine learning for software engineering

来源：评论

学校读者我要写书评

暂无评论

Automatic Detection for javascript obfuscation Attacks in Web Pages through String Pattern Analysis

引用

INTERNATIONAL JOURNAL OF SECURITY AND ITS APPLICATIONS 2010年第2期4卷 13-26页

作者： Choi, YoungHan Kim, TaeGhyoon Choi, SeokJin Attached Inst ETRI Daejeon South Korea

Recently, most of malicious web pages include obfuscated codes in order to circumvent the detection of signature-based detection systems. It is difficult to decide whether the sting is obfuscated because the shape of obfuscated strings are changed continuously. In this paper, we propose a novel methodology that can detect obfuscated strings in the malicious web pages. We extracted three metrics as rules for detecting obfuscated strings by analyzing patterns of normal and malicious javascript codes. They are N-gram, Entropy, and Word Size. N-gram checks how many each byte code is used in strings. Entropy checks distributed of used byte codes. Word size checks whether there is used very long string. Based on the metrics, we implemented a practical tool for our methodology and evaluated it using read malicious web pages. The experiment results showed that our methodology can detect obfuscated strings in web pages effectively.

关键词： javascript obfuscation Malicious Code Detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：