2020年9月
Deobfuscation, unpacking, and decoding of obfuscated malicious JavaScript for machine learning models detection performance improvement
CAAI TRANSACTIONS ON INTELLIGENCE TECHNOLOGY
- ,
- ,
- 巻
- 5
- 号
- 3
- 開始ページ
- 184
- 終了ページ
- 192
- 記述言語
- 英語
- 掲載種別
- 研究論文(学術雑誌)
- DOI
- 10.1049/trit.2020.0026
- 出版者・発行元
- INST ENGINEERING TECHNOLOGY-IET
Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi-layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD-preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.
- リンク情報
-
- DOI
- https://doi.org/10.1049/trit.2020.0026
- DBLP
- https://dblp.uni-trier.de/rec/journals/caaitrit/NdichuKO20
- Web of Science
- https://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=JSTA_CEL&SrcApp=J_Gate_JST&DestLinkType=FullRecord&KeyUT=WOS:000597168000007&DestApp=WOS_CPL
- 共同研究・競争的資金等の研究課題
- Web媒介型攻撃対策技術の実用化に向けた研究開発
- URL
- https://dblp.uni-trier.de/db/journals/caaitrit/caaitrit5.html#NdichuKO20
- ID情報
-
- DOI : 10.1049/trit.2020.0026
- ISSN : 2468-6557
- eISSN : 2468-2322
- DBLP ID : journals/caaitrit/NdichuKO20
- Web of Science ID : WOS:000597168000007