論文

査読有り 責任著者
2020年9月

Deobfuscation, unpacking, and decoding of obfuscated malicious JavaScript for machine learning models detection performance improvement

CAAI TRANSACTIONS ON INTELLIGENCE TECHNOLOGY
  • Samuel Ndichu
  • ,
  • Sangwook Kim
  • ,
  • Seiichi Ozawa

5
3
開始ページ
184
終了ページ
192
記述言語
英語
掲載種別
研究論文(学術雑誌)
DOI
10.1049/trit.2020.0026
出版者・発行元
INST ENGINEERING TECHNOLOGY-IET

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi-layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD-preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.

リンク情報
DOI
https://doi.org/10.1049/trit.2020.0026
DBLP
https://dblp.uni-trier.de/rec/journals/caaitrit/NdichuKO20
Web of Science
https://gateway.webofknowledge.com/gateway/Gateway.cgi?GWVersion=2&SrcAuth=JSTA_CEL&SrcApp=J_Gate_JST&DestLinkType=FullRecord&KeyUT=WOS:000597168000007&DestApp=WOS_CPL
共同研究・競争的資金等の研究課題
Web媒介型攻撃対策技術の実用化に向けた研究開発
URL
https://dblp.uni-trier.de/db/journals/caaitrit/caaitrit5.html#NdichuKO20
ID情報
  • DOI : 10.1049/trit.2020.0026
  • ISSN : 2468-6557
  • eISSN : 2468-2322
  • DBLP ID : journals/caaitrit/NdichuKO20
  • Web of Science ID : WOS:000597168000007

エクスポート
BibTeX RIS