检索结果-内蒙古大学图书馆

Looking for Criminal Intents in javascript Obfuscated Code

Procedia Computer Science 2022年 207卷 867-876页

作者： Federico Cerutti Daniele Barattieri di San Pietro Francesco Gringoli Gianfranco Lamperti Department of Information Engineering University of Brescia 25123 Brescia Italy

The majority of websites incorporate javascript for client-side execution in a supposedly protected environment. Unfortunately, javascript has also proven to be a critical attack vector for both independent and state-sponsored groups of hackers. On the one hand, defenders need to analyze scripts to ensure that no threat is delivered and to respond to potential security incidents. On the other, attackers aim to obfuscate the source code in order to disorient the defenders or even to make code analysis practically impossible. Since code obfuscation may also be adopted by companies for legitimate intellectual-property protection, a dilemma remains on whether a script is harmless or malignant, if not criminal. To help analysts deal with such a dilemma, a methodology is proposed, called JACOB, which is based on five steps, namely: (1) source code parsing, (2) control flow graph recovery, (3) region identification, (4) code structuring, and (5) partial evaluation. These steps implement a sort of decompilation for control flow fattened code, which is progressively transformed into something that is close to the original javascript source, thereby making eventual code analysis possible. Most relevantly, JACOB has been successfully applied to uncover unwanted user tracking and fingerprinting in e-commerce websites operated by a well-known Chinese company.

关键词： javascript web cybercrime code obfuscation code deobfuscation ccontrol flow flattening reverse engineering e-commerce user tracking fingerprinting

来源：评论

学校读者我要写书评

暂无评论

To Block or Not to Block: Accelerating Mobile Web Pages On-The-Fly Through javascript Classification 2022

To Block or Not to Block: Accelerating Mobile Web Pages On-T...

引用

International Conference on Information & Communication Technologies and Development 2022

作者： Moumena Chaqfeh Muhammad Haseeb Waleed Hashmi Patrick Inshuti Manesha Ramesh Matteo Varvello Lakshminarayanan Subramanian Fareed Zaffar Yasir Zaki New York University Abu Dhabi USA Lahore University of Management Sciences Pakistan Nokia Bell Labs USA New York University USA New York University Abu Dhabi UAE

ISBN: (纸本)9781450397872

The increasing complexity of javascript (JS) in modern mobile web pages has become a performance bottleneck for low-end mobile phone users, especially in developing regions. In this paper we propose SlimWeb, a novel approach that automatically derives lightweight versions of mobile web pages on-the-fly by eliminating non-essential javascript that does not impact the core page content and interactive functionality. SlimWeb consists of a javascript classification service powered by a supervised Machine Learning (ML) model that provides insights into each javascript element embedded in a web page. SlimWeb aims to improve the web browsing experience by predicting the class of each element, such that essential elements are preserved and non-essential elements are blocked by the browsers using the service. We motivate SlimWeb’s core design via a preference survey where 306 users overwhelmingly preferred having faster page load times over fetching various categories of non-essential javascript. We evaluate SlimWeb across 500 popular web pages in a developing region on real cellular networks, along with a user experience study with 20 real-world users and a usage willingness survey of 588 users. Evaluation results show that SlimWeb achieves 50% reduction in page load time compared to the original pages, and more than 30% reduction compared to competing solutions, while achieving high similarity scores to the original pages measured via a qualitative evaluation study with 62 users. SlimWeb improves the overall user experience metric (defined by Google Lighthouse combining first contentful paint, time to interactive, speed index) by more than 60% compared to the original pages, while maintaining 90-100% of the visual and functional components of most pages.

关键词： Classification javascript User Experience Mobile Web

来源：评论

学校读者我要写书评

暂无评论

基于深度学习的小程序恶意javascript代码检测系统的研究与实现

基于深度学习的小程序恶意JavaScript代码检测系统的研究与实现

引用

作者：任杰北京邮电大学

学位级别：硕士

近年来,小程序因其无需安装即可使用的优点发展迅速,然而与之相对的是现有的小程序检测方法较为落后——以各种杀毒软件为代表的基于签名或模式的传统检测方法易受到代码混淆的影响,而目前的基于深度学习的检测模型大多为通用检测模型,... 详细信息

近年来,小程序因其无需安装即可使用的优点发展迅速,然而与之相对的是现有的小程序检测方法较为落后——以各种杀毒软件为代表的基于签名或模式的传统检测方法易受到代码混淆的影响,而目前的基于深度学习的检测模型大多为通用检测模型,对于小程序检测场景中特有的数据集不平衡,版本间代码重复多等特点未能做出相应适配,导致其检测精度和效率均有损失。本论文基于以上背景,提出了一种基于树状卷积神经网络的新型检测模型,针对于小程序情景下的非平衡数据集问题,使用过采样方法扩充小程序场景下的非平衡数据集,利用注意力机制使得模型能够重点关注恶意特征;针对小程序场景下版本间代码重复多问题,提出并使用了标记法求出了代码的最大影响树从而建模了代码的极大影响面,加快了模型检测速度。本文通过一系列实验证实了所设计模型在小程序代码检测场景下的优秀表现,在一系列评价指标上本文所设计模型相较于基线模型均有提升。同时本文也对小程序检测系统进行了工程实现,本文通过严谨的架构设计和详尽的测试保证了整个系统的可行性、可靠性,稳定性,最终实现了整个检测系统的顺利落地。

关键词：深度学习小程序抽象语法树恶意代码检测 javascript

来源：评论

学校读者我要写书评

暂无评论

Juicing V8: A primary account for the memory forensics of the V8 javascript engine

引用

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION 2022年 42卷

作者： Wang, Enoch Zurowski, Samuel Duffy, Orion Thomas, Tyler Baggili, Ibrahim Univ New Haven Samuel S Bergami Jr Cybersecur Ctr Cyber Forens Res & Educ Grp UNHcFREG West Haven CT 06516 USA Univ New Haven Connecticut Inst Technol West Haven CT USA

V8 is the open source interpreter developed by Google to enable javascript (JS) functionality in Chrome and power other software. Malicious threat actors abuse the usage of JS because most modern-day browsers implicitly trust script code to execute. To aid in incident response and memory forensics in such scenarios, our work introduces the first generalizable account of the memory forensics of the V8 JS engine and provides practitioners with a list of objects and their descriptors extracted from a memory image. These objects can be used to reveal key information about a user and their activity. We analyzed the V8 engine and its garbage collection process. We then developed and validated a Volatility plugin - V8MapScan - to reconstruct V8 objects from a memory image. The runtime of the V8 engine is housed within the V8 isolate which contains its own heap manager and garbage collector. Within the heap of the isolate exists a root object map known as the MetaMap. By using the MetaMap and a object-fitting technique, we were able to extract objects, object-maps, and object properties. The V8MapScan plugin scans process memory for the MetaMap data structure contained within the V8 isolate using its data structure, references to objects can be found and extracted. Our findings were verified with Chrome DevTool's Heap Profiler. Our approach recovered the majority of objects indicated by the heap profiler with common types such as the ONE_BYTE_INTERNALIZED_STR type returning more than 98.9%. Lastly, we provide a case study using our tools on the Monero Cryptocurrency Miner. (C) 2022 The Authors. Published by Elsevier Ltd.

关键词： Memory forensics Volatility V8 javascript Memory analysis Object recovery

来源：评论

学校读者我要写书评

暂无评论

Segment-Based Multiple-Base Compressed Addressing for Flexible javascript Heap Allocation

引用

IEEE ACCESS 2020年 8卷 185405-185415页

作者： Hong, Gyeonghwan Shin, Dongkun Sungkyunkwan Univ Dept Elect & Comp Engn Suwon 16419 South Korea

Many Internet-of-Things (IoT) systems use lightweight javascript engines to support easy programming in microcontrollers. Lightweight javascript engines use several techniques for memory optimization, such as static heap reservation and compressed addressing. Recent IoT systems also use several external libraries and a larger on-chip memory to support abundant functionalities, such as machine learning and connectivity. However, as the javascript heap space is not resizable owing to the memory optimizations, the javascript engine or an external library is prone to fail the memory allocation in these devices. To address this problem, we propose a flexible memory optimization technique, segment-based multiple-base compressed addressing (SMBCA), which compresses a pointer indicating a javascript object allocated to a resizable heap based on multiple base addresses. SMBCA comprises two components: a dynamic segment allocator (DSA) and a multiple-base compressed address translator (MBCAT). DSA dynamically allocates the javascript heap in segment units. Meanwhile, MBCAT converts a low-bitwidth address into a full-bitwidth address and vice versa, based on the multiple base addresses. To reduce the address compression overhead of MBCAT, we propose a software cache technique, reverse map cache (RMC). We found that the SMBCA reduces average memory usage by 43.9% compared to the existing lightweight javascript engines when running SunSpider benchmarks, V8 benchmarks, and real-world applications. We also showed that the RMC reduces the average address compression latency of MBCAT by 34.9% when running the SunSpider benchmarks.

关键词： Compressed addressing Internet of Things javascript memory management microcontroller

来源：评论

学校读者我要写书评

暂无评论

面向javascript引擎报错机制的类别导向模糊测试方法

面向JavaScript引擎报错机制的类别导向模糊测试方法

引用

作者：卢凌大连理工大学

学位级别：硕士

报错机制是javascript引擎中至关重要的一部分。javascript引擎的开发人员不可避免地都会编写出错误的javascript程序。面对错误的程序,javascript引擎报错机制应输出合理的错误信息,指出错误的原因和位置,帮助开发人员修复错误。然而,J... 详细信息

报错机制是javascript引擎中至关重要的一部分。javascript引擎的开发人员不可避免地都会编写出错误的javascript程序。面对错误的程序,javascript引擎报错机制应输出合理的错误信息,指出错误的原因和位置,帮助开发人员修复错误。然而,javascript引擎报错机制中存在缺陷,存在缺陷的报错机制会抛出令开发人员困惑的错误信息、指向不存在错误的代码片段、阻碍开发人员修复错误的javascript程序。为了完善javascript引擎的报错机制,本文提出了面向javascript引擎报错机制的类别导向的模糊测试方法CAFJER。CAFJER将javascript引擎报错机制抛出的错误信息分为61类,并实现了增改API、插入函数模板以及更改符号三种变异方法,使变异后的测试用例能够触发所有类别的错误信息。给定一个种子程序,CAFJER首先为其选择一个目标类别的错误信息,并通过动态分析得到种子文件的上下文信息。之后,CAFJER随机选择一个目标类别错误信息对应的变异方法,根据种子程序的上下文信息生成能触发目标类别错误信息的测试用例。接着,CAFJER将生成的测试用例输入不同javascript引擎中进行差分测试,对报错机制输出的错误信息进行比较,若其中存在差异,说明CAFJER可能发现了一个javascript引擎报错机制中的缺陷,并输出相应的缺陷报告。最后,根据模糊测试的历史数据,CAFJER自动过滤重复的和无效的缺陷报告,有效减少了人工的参与。为了验证CAFJER的有效性,我们将CAFJER与目前先进的相似方法JEST和DIPROM进行比较,实验结果表明,CAFJER发现javascript引擎报错机制中缺陷的能力分别是JEST和DIPROM的2.17倍以及26.00倍。3个月实验中,CAFJER共向javascript引擎的开发者提交了17个缺陷报告,其中7个已被开发者确认,CAFJER对真实世界中javascript引擎报错机制缺陷的检测工作得到了开发者的认可。

关键词： javascript 报错机制错误信息差分测试程序变异

来源：评论

学校读者我要写书评

暂无评论

Understanding javascript Vulnerabilities in Large Real-World Android Applications

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2020年第5期17卷 1063-1078页

作者： Song, Wei Huang, Qingqing Huang, Jeff Nanjing Univ Sci & Technol Sch Comp Sci & Engn Nanjing 210094 Peoples R China Texas A&M Univ Dept Comp Sci & Engn College Stn TX 77843 USA

javascript-related vulnerabilities are becoming a major security threat to hybrid mobile applications. In this article, we present a systematic study to understand how javascript is used in real-world Android apps and how it may lead to security vulnerabilities. We begin by conducting an empirical study on the top-100 most popular Android apps to investigate javascript usage and its related security vulnerabilities. Our study identifies four categories of javascript usage and finds that three of these categories, if inappropriately used, can respectively lead to three types of vulnerabilities. We also design and implement an automatic tool named JSDroid to detect javascript-related vulnerabilities. We have applied JSDroid to 1,000 large real-world Android apps and found that over 70 percent of these apps have potential javascript-related vulnerabilities and 20 percent of them can be successfully exploited. Moreover, based on the vulnerabilities identified by JSDroid, we have successfully launched real attacks on 30 real- world apps.

关键词： Android apps javascript WebView security vulnerabilities empirical study

来源：评论

学校读者我要写书评

暂无评论

检测javascript类的内聚耦合Code Smell

引用

软件学报 2021年第8期32卷 2505-2521页

作者：黄子杰陈军华高建华上海师范大学计算机科学与技术系上海200234 华东理工大学计算机科学与工程系上海200237

Code Smell是软件程序中存在不良设计和不良实现的征兆.正确地检测和识别Code Smell可以指导软件重构,提高软件的可用性和可靠性.通过Code Smell的度量指标,可以量化软件的设计问题.javascript已成为最常用的编程语言之一,类是JavaScrip... 详细信息

Code Smell是软件程序中存在不良设计和不良实现的征兆.正确地检测和识别Code Smell可以指导软件重构,提高软件的可用性和可靠性.通过Code Smell的度量指标,可以量化软件的设计问题.javascript已成为最常用的编程语言之一,类是javascript的设计模式,优秀类的设计体现为高内聚和低耦合.现有关于javascript内聚耦合的Code Smell研究均在微观的层面,即函数和语句上进行.它们可以提供程序实现的重构建议,但无法分析内聚耦合相关的软件系统设计问题.针对FE、DC和Blob这3种类的内聚耦合Code Smell,提出一种javascript类的内聚耦合Code Smell检测方法JS4C.该方法基于静态分析,同时适用于客户端和服务端程序.它通过遍历软件系统中所有的类,利用源程序的文本相似度特征和结构特征,识别Code Smell并检测其强度.在结构特征检测中,JS4C使用了经扩展的对象类型推断及非严格的耦合分散度度量法NSCDISP,有效地降低了解释型语言的静态分析过程中,类型信息缺失对检测产生的影响.实验通过对6个开源项目的分析表明,JS4C对内聚耦合设计问题有良好的检测效果.

关键词： Code Smell javascript 内聚耦合类

来源：评论

学校读者我要写书评

暂无评论

Platform-Independent Dynamic Taint Analysis for javascript

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2020年第12期46卷 1364-1379页

作者： Karim, Rezwana Tip, Frank Sochurkova, Alena Sen, Koushik Samsung Res Amer Mountain View CA 94043 USA Northeastern Univ Coll Comp & Informat Sci Boston MA 02115 USA Avast Prague 14000 Czech Republic Univ Calif Berkeley Berkeley CA 94720 USA

Previous approaches to dynamic taint analysis for javascript are implemented directly in a browser or javascript engine, limiting their applicability to a single platform and requiring ongoing maintenance as platforms evolve, or they require nontrivial program transformations. We present an approach that relies on instrumentation to encode taint propagation as instructions for an abstract machine. Our approach has two key advantages: it is platform-independent and can be used with any existing javascript engine, and it can track taint on primitive values without requiring the introduction of wrapper objects. Furthermore, our technique enables multiple deployment scenarios by varying when and where the generated instructions are executed and it supports indirect taint sources, i.e., situations where taint enters an application via arguments passed to dynamically registered event-listener functions. We implemented the technique for the ECMAScript 5 language in a tool called Ichnaea, and evaluated it on 22 NPM modules containing several types of injection vulnerabilities, including 4 modules containing vulnerabilities that were not previously discovered and reported. On these modules, run-time overheads range from 3.17x to 38.42x, which is significantly better than a previous transformation-based technique. We also report on a case study that shows how Ichnaea can be used to detect privacy leaks in a Tizen web application for the Samsung Gear S2 smart watch.

关键词： Instruments Engines Browsers Tools Privacy Gears Data privacy Taint analysis dynamic analysis javascript platform-independent instrumentation

来源：评论

学校读者我要写书评

暂无评论

Deobfuscation,unpacking,and decoding of obfuscated malicious javascript for machine learning models detection performance improvement

引用

CAAI Transactions on Intelligence Technology 2020年第3期5卷 184-192页

作者： Samuel Ndichu Sangwook Kim Seiichi Ozawa Graduate School of Engineering Kobe UniversityKobe CityJapan Center for Mathematical and Data Sciences Kobe UniversityKobe CityJapan

Obfuscation is rampant in both benign and malicious javascript(JS)*** generates an obscure and undetectable code that hinders comprehension and ***,accurate detection of JS codes that masquerade as innocuous scripts is *** existing deobfuscation methods assume that a specific tool can recover an original JS code *** a multi-layer obfuscation,general tools realize a formatted JS code,but some sections remain *** the detection of such codes,this study performs Deobfuscation,Unpacking,and Decoding(DUD-preprocessing)by function redefinition using a Virtual Machine(VM),a JS code editor,and a python int_to_str()function to facilitate feature learning by the FastText *** learned feature vectors are passed to a classifier model that judges the maliciousness of a JS *** performance evaluation,the authors use the Hynek Petrak’s dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS *** then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS *** experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.

关键词： javascript editor python

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：