Malicious JavaScript Detection by Features Extraction

Abstract

In recent years, JavaScript-based attacks have become one of the most common and successful types of attack. Existing techniques for detecting malicious JavaScripts could fail for dierent reasons. Some techniques are tailored on specific kinds of attacks, and are ineective for others. Some other techniques require costly computational resources to be implemented. Other techniques could be circumvented with evasion methods. This paper proposes a method for detecting malicious JavaScript code based on five features that capture dierent characteristics of a script: execution time, external referenced domains and calls to JavaScript functions. Mixing dierent types of features could result in a more eective detection technique, and overcome the limitations of existing tools created for identifying malicious JavaScript. The experimentation carried out suggests that a combination of these features is able to successfully detect malicious JavaScript code (in the best cases we obtained a precision of 0.979 and a recall of 0.978).