检索结果-内蒙古大学图书馆

MOJI: Character-level convolutional neural networks for Malicious Obfuscated javascript Inspection

APPLIED SOFT COMPUTING 2023年 137卷

作者： Ishida, Minato Kaneko, Naoshi Sumi, Kazuhiko Aoyama Gakuin Univ 5-10-1 FuchinobeChuo Ku Sagamihara Kanagawa 2525258 Japan

javascript malware is one of the major threats to web security. A big challenge in detecting such malicious javascript is obfuscation, which transforms a program code into a harder-to-understand representation while preserving its original functionality. Many malicious javascript detection meth-ods perform code abstraction and prior feature extraction to uncover the functionality hidden by obfuscation. However, such preprocessing steps significantly limit the detectors' efficiency in practical situations. This paper presents Malicious Obfuscated javascript Inspector (MOJI), a novel method for malicious javascript detection, which requires no code abstraction or prior feature extraction. Instead, our detector directly accepts a sequence of characters in javascript code as an input and outputs its maliciousness score. Specifically, we design a character-level convolutional neural network consisting mainly of several 1D convolutional layers and fully connected layers. We evaluate the proposed method on a dataset composed of 24,000 javascript codes and show that our method outperforms existing malicious javascript detectors in terms of both detection performance and running time. We also provide an analysis of the effect of additional obfuscation on the same dataset. Our results indicate that MOJI is far more robust to obfuscation than the existing methods and commercial antivirus software. (c) 2023 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license (http://***/licenses/by-nc-nd/4.0/).

关键词： Malware detection javascript Convolutional neural networks Deep learning

来源：评论

学校读者我要写书评

暂无评论

Benefits, challenges, and usability evaluation of DeloreanJS: a back-in-time debugger for javascript

引用

PEERJ COMPUTER SCIENCE 2023年 9卷 e1238页

作者： Leger, Paul Ruiz, Felipe Fukuda, Hiroaki Cardozo, Nicolas Univ Catolica Norte Escuela Ingn Coquimbo Elqui Chile Shibaura Inst Technol Tokyo Japan Univ Los Andes Bogota Colombia

javascript Web applications are a common product in industry. As with most applica-tions, Web applications can acquire software flaws (known as bugs), whose symptoms are seen during the development stage and, even worse, in production. The use of debuggers is beneficial for detecting bugs. Unfortunately, most javascript debuggers (1) only support the "step into/through"feature in an execution program to detect a bug, and (2) do not allow developers to go back-in-time at the application execution to take actions to detect the bug accurately. For example, the second limitation does not allow developers to modify the value of a variable to fix a bug while the application is running or test if the same bug is triggered with other values of that variable. Using concepts such as continuations and static analysis, this article presents a usable debugger for javascript, named DeloreanJS, which enables developers to go back-in-time in different execution points and resume the execution of a Web application to improve the understanding of a bug, or even experiment with hypothetical scenarios around the bug. Using an online and available version, we illustrate the benefits of DeloreanJS through five examples of bugs in javascript. Although DeloreanJS is developed for javascript, a dynamic prototype-based object model with side effects (mutable variables), we discuss our proposal with the state-of-art/practice of debuggers in terms of features. For example, modern browsers like Mozilla Firefox include a debugger in their distribution that only support for the breakpoint feature. However DeloreanJS uses a graphical user interface that considers back-in-time features. The aim of this study is to evaluate and compare the usability of DeloreanJS and Mozilla Firefox's debugger using the system usability scale approach. We requested 30 undergraduate students from two computer science programs to solve five tasks. Among the findings, we highlight two results. First, we found that 100%

关键词： Programming Languages Engineering Web applications Programming language Software engineering Usability evaluation javascript Debugger

来源：评论

学校读者我要写书评

暂无评论

PhyloJS: Bridging phylogenetics and web development with a javascript utility library

引用

ECOLOGY AND EVOLUTION 2024年第6期14卷 e11603页

作者： Featherstone, Leo A. Wirth, Wytamma Univ Melbourne Peter Doherty Inst Infect & Immun Melbourne Vic Australia

There is an increasing number of libraries devoted to parsing, manipulating and visualising phylogenetic trees in javascript. Many of these libraries bundle tree manipulation with visualisation, but have limited ability to manipulate trees and lack detailed documentation. As the number of web-based phylogenetic tools and the size of phylogenetics datasets increases, there is a need for a library that parses, writes and manipulates phylogenetic trees that is interoperable with other phylogenetic and data visualisation libraries. Here we introduce PhyloJS, a light zero-dependency TypeScript and javascript library for reading, writing and manipulating phylogenetic trees. PhyloJS allows for modification of and data-extraction from trees to integrate with other phylogenetics and data visualisation libraries. It can swiftly handle large trees, up to at least (6)(10) tips in size, making it ideal for developing the next generation of more complex web-based phylogenetics applications handling ever larger datasets. The PhyloJS source code is available on GitHub (https://***/clockor2/phylojs) and can be installed via npm with the command npm install phylojs. Extensive documentation is available at https://***/phylojs/.

关键词： javascript Phylogenetics Web-Development

来源：评论

学校读者我要写书评

暂无评论

HIJaX: Human Intent to javascript XSS Generator

HIJaX: Human Intent to Javascript XSS Generator

引用

作者： Frempong, Yaw The University of North Carolina at Charlotte

学位级别：M.S., Master of Science/Master of Surgery

Websites remain popular targets for Cross-Site Scripting (XSS) attacks. Although the prevalence of XSS attacks is on the rise, many developers do not have the cybersecurity expertise to secure their web applications against these attacks. Non-security experts are often unfamiliar with writing and understanding exploit code making it difficult for them do web security tasks such as penetration testing and understanding the malicious intentions of an attacker who is targeting their web application. Automated Exploit Generation (AEG) is one solution for preemptively securing web applications against XSS attacks. Additionally, Natural Language Processing (NLP) can allow non-security experts to utilize natural language to generate exploit code and use exploit code to generate natural language descriptions of an attacker's intentions. This thesis presents HIJaX, a novel Natural Language-to-javascript generator prototype that combines NLP and AEG to do bi-directional English and code translations. This allows HIJaX to generate XSS attack code from English sentences as well as English sentences that explain the intentions of an attack, from XSS attack code. HIJaX provides non-security experts in the Software Development Life Cycle with a tool that allows them to understand and write XSS attacks without needing to have substantial knowledge in the field of cybersecurity. HIJaX utilizes CodeBERT, a state-of-the-art language model created by Microsoft for the purpose of translating between natural language and programming code in real-time. HIJaX trains on the malicious dataset, a curated collection of intent-snippet pairs where the intent is an English description an XSS attack and the snippet is the XSS attack code. This thesis explores different methods for dataset creation, discusses experiments that measure the usability of HIJaX, and presents the results of a user study that examines how non-security experts view HIJaX as a viable option to secure their web applications.

关键词： Cross-site scripting Exploit generation javascript Natural language processing

来源：评论

学校读者我要写书评

暂无评论

BUGSJS: a benchmark and taxonomy of javascript bugs

引用

SOFTWARE TESTING VERIFICATION & RELIABILITY 2021年第4期31卷 e1751-e1751页

作者： Gyimesi, Peter Vancsics, Bela Stocco, Andrea Mazinanian, Davood Beszedes, Arpad Ferenc, Rudolf Mesbah, Ali Univ Szeged Dept Software Engn Szeged Hungary Univ Svizzera Italiana Software Inst Lugano Switzerland Univ British Columbia Dept Elect & Comp Engn Vancouver BC Canada

javascript is a popular programming language that is also error-prone due to its asynchronous, dynamic, and loosely typed nature. In recent years, numerous techniques have been proposed for analyzing and testing javascript applications. However, our survey of the literature in this area revealed that the proposed techniques are often evaluated on different datasets of programs and bugs. The lack of a commonly used benchmark limits the ability to perform fair and unbiased comparisons for assessing the efficacy of new techniques. To fill this gap, we proposeBugsJS, a benchmark of 453 real, manually validated javascript bugs from 10 popular javascript server-side programs, comprising 444k lines of code (LOC) in total. Each bug is accompanied by its bug report, the test cases that expose it, as well as the patch that fixes it. We extendedBugsJSwith a rich web interface for visualizing and dissecting the bugs' information, as well as a programmable API to access the faulty and fixed versions of the programs and to execute the corresponding test cases, which facilitates conducting highly reproducible empirical studies and comparisons of javascript analysis and testing tools. Moreover, following a rigorous procedure, we performed a classification of the bugs according to their nature. Our internal validation shows that our taxonomy is adequate for characterizing the bugs inBugsJS. We discuss several ways in which the resulting taxonomy and the benchmark can help direct researchers interested in automated testing of javascript applications.

关键词： javascript bug database benchmark reproducibility bug taxonomy BugsJS

来源：评论

学校读者我要写书评

暂无评论

A Toolkit of Methods and Benchmarks for Analyzing Mobile javascript 24

A Toolkit of Methods and Benchmarks for Analyzing Mobile Jav...

引用

Companion Proceedings of the ACM on Web Conference 2024

作者： Usama Naseer Theophilus A. Benson Brown University Providence RI USA Carnegie Mellon University -- Africa Kigali Rwanda

ISBN: (纸本)9798400701726

javascript remains the dominant mode for creating dynamic and rich content. Yet, we lack principled techniques for performing fine- grained analysis of the memory implications of modern javascript libraries. In this paper, we take a step towards address this need by introducing a synthetic benchmark, JSBench, and a novel statistical toolkit for dissecting and understanding behavior.

关键词： javascript

来源：评论

学校读者我要写书评

暂无评论

JSISOLATE: Lightweight In-Browser javascript Isolation 2021

JSISOLATE: Lightweight In-Browser JavaScript Isolation

引用

29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)

作者： Zhang, Mingxue Meng, Wei Chinese Univ Hong Kong Hong Kong Peoples R China

ISBN: (纸本)9781450385626

Modern web applications commonly include third-party scripts from external hosts. While enabling code reuse and enhancing the functionalities, the reliability of client-side javascript code can be impaired by the inclusion of other scripts. Since all scripts run in the same execution environment in the browser, executing them all together may cause unexpected effects. For example, global variables with the same name might be defined by multiple scripts, causing the actual value to be unpredictable. In this paper, we design a lightweight browser-based framework, JSISOLATE, that provides an isolated and reliable javascript execution environment. JSISOLATE injects scripts into different isolated environments based on their dependency relationship. In this way, it executes scripts with independent functionalities in different contexts, effectively preventing them from interfering with each other. We further evaluated the compatibility and performance overhead of JSISOLATE on Alexa top 1K websites, and showed that it can efficiently isolate scripts while preserving the functionalities.

关键词： javascript Script isolation Web browser

来源：评论

学校读者我要写书评

暂无评论

JSTAR: javascript Specification Type Analyzer using Refinement 36

JSTAR: JavaScript Specification Type Analyzer using Refineme...

引用

36th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Park, Jihyeok An, Seungmin Shin, Wonho Sim, Yusung Ryu, Sukyoung Korea Adv Inst Sci & Technol Sch Comp Daejeon South Korea

ISBN: (纸本)9781665403375

javascript is one of the mainstream programming languages for client-side programming, server-side programming, and even embedded systems. Various javascript engines developed and maintained in diverse fields must conform to the syntax and semantics described in ECMAScript, the standard specification of javascript. Since an incorrect description in ECMAScript can lead to wrong javascript engine implementations, checking the correctness of ECMAScript is critical and essential. However, all the specification updates are currently manually reviewed by the Ecma Technical Committee 39 (TC39) without any automated tools. Moreover, in late 2014, the committee announced the yearly release cadence and open development process of ECMAScript to quickly adapt to evolving development environments. Because of such frequent updates, checking the correctness of ECMAScript becomes more labor-intensive and error-prone. To alleviate the problem, we propose JSTAR, a javascript Specification Type Analyzer using Refinement. It is the first tool that performs type analysis on javascript specifications and detects specification bugs using a bug detector. For a given specification, JSTAR first compiles each abstract algorithm written in a structured natural language to a corresponding function in IRES, an untyped intermediate representation for ECMAScript. Then, it performs type analysis for compiled functions with specification types defined in ECMAScript. Based on the result of type analysis, JSTAR detects specification bugs using a bug detector consisting of four checkers. To increase the precision of the type analysis, we present condition-based refinement for type analysis, which prunes out infeasible abstract states using conditions of assertions and branches. We evaluated JSTAR with all 864 versions in the official ECMAScript repository for the recent three years from 2018 to 2021. JSTAR took 137.3 seconds on average to perform type analysis for each version, and detected 157 type-re

关键词： javascript mechanized specification type analysis refinement bug detection

来源：评论

学校读者我要写书评

暂无评论

Statically Detecting javascript Obfuscation and Minification Techniques in the Wild 51

Statically Detecting JavaScript Obfuscation and Minification...

引用

51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)

作者： Moog, Marvin Demmel, Markus Backes, Michael Fass, Aurore Saarland Univ Saarbrucken Germany CISPA Helmholtz Ctr Informat Secur Saarbrucken Germany

ISBN: (纸本)9781665435727

javascript is both a popular client-side programming language and an attack vector. While malware developers transform their javascript code to hide its malicious intent and impede detection, well-intentioned developers also transform their code to, e.g., optimize website performance. In this paper, we conduct an in-depth study of code transformations in the wild. Specifically, we perform a static analysis of javascript files to build their Abstract Syntax Tree (AST), which we extend with control and data flows. Subsequently, we define two classifiers, benefitting from AST-based features, to detect transformed samples along with specific transformation techniques. Besides malicious samples, we find that transforming code is increasingly popular on *** libraries and client-side javascript, with, e.g., 90% of Alexa Top 10k websites containing a transformed script. This way, code transformations are no indicator of maliciousness. Finally, we showcase that benign code transformation techniques and their frequency both differ from the prevalent malicious ones.

关键词： Web Security javascript Obfuscation Minification Empirical Study

来源：评论

学校读者我要写书评

暂无评论

javascript: The First 20 Years

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2020年第HOPL期4卷 1–189页

作者： Wirfs-Brock, Allen Eich, Brendan Wirfs Brock Associates Inc Sherwood OR 97140 USA Brave Software Inc San Francisco CA USA

How a sidekick scripting language for Java, created at Netscape in a ten-day hack, ships first as a de facto Web standard and eventually becomes the world's most widely used programming language. This paper tells the story of the creation, design, evolution, and standardization of the javascript language over the period of 1995-2015. But the story is not only about the technical details of the language. It is also the story of how people and organizations competed and collaborated to shape the javascript language which dominates the Web of 2020.

关键词： javascript ECMAScript Standards Web browsers Browser game theory History of programming languages

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：