Abstract
Attackers use a variety of techniques to insert redirection JavaScript that leads a user to a malicious webpage, where a drive-by-download attack is executed. In particular, the redirection JavaScript in the landing site is obfuscated to avoid detection systems. In this paper, we propose a lightweight detection system based on static analysis to classify the obfuscation type and to promptly detect the obfuscated redirection JavaScript. The proposed model detects the obfuscated redirection JavaScript by converting the JavaScript into an abstract syntax tree (AST). Then, the structure and token information are extracted. Specifically, we propose a lightweight AST to identify the obfuscation type and the revised term frequency-inverse document frequency to efficiently detect the malicious redirection JavaScript. This approach enables rapid identification of the obfuscated redirection JavaScript and proactive blocking of the webpages that are used in drive-by-download attacks.
Highlights
The number of cyber-attacks that occur has continued to grow exponentially as web-related technologies and infrastructures have continually advanced
At the token similarity computation step, we check whether the JavaScript contains redirection code by using the average of term frequency–inverse document frequency (TF-IDF) of tokens corresponding to the obfuscation type
We proposed a static analysis system based on an abstract syntax tree (AST) to detect obfuscated JavaScript
Summary
The number of cyber-attacks that occur has continued to grow exponentially as web-related technologies and infrastructures have continually advanced. Malicious files downloaded to a user’s computer can harm the user by leaking the user’s credentials, including personal information. This attack may affect governments or any other organization by the subsequent execution of distributed denial of service attacks. Kishore et al [2] introduced a relation of drive-by-download and obfuscated JavaScript well and proposed their detection system. Attackers can bypass these detection systems based on static analysis by applying obfuscation tools to the JavaScript. Obfuscation was originally used to prevent the direct exposure of source code; attackers began exploiting obfuscation tools to hide their malicious JavaScript.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
