Malicious JavaScript Research Articles

Malicious JavaScript Detection in Realistic Environments with SVM and MLP Models

Malicious JavaScript Detection in Realistic Environments with SVM and MLP Models

MOJI: Character-level convolutional neural networks for Malicious Obfuscated JavaScript Inspection

JavaScript malware is one of the major threats to web security. A big challenge in detecting such malicious JavaScript is obfuscation, which transforms a program code into a harder-to-understand representation while preserving its original functionality. Many malicious JavaScript detection methods perform code abstraction and prior feature extraction to uncover the functionality hidden by obfuscation. However, such preprocessing steps significantly limit the detectors’ efficiency in practical situations. This paper presents Malicious Obfuscated JavaScript Inspector (MOJI), a novel method for malicious JavaScript detection, which requires no code abstraction or prior feature extraction. Instead, our detector directly accepts a sequence of characters in JavaScript code as an input and outputs its maliciousness score. Specifically, we design a character-level convolutional neural network consisting mainly of several 1D convolutional layers and fully connected layers. We evaluate the proposed method on a dataset composed of 24,000 JavaScript codes and show that our method outperforms existing malicious JavaScript detectors in terms of both detection performance and running time. We also provide an analysis of the effect of additional obfuscation on the same dataset. Our results indicate that MOJI is far more robust to obfuscation than the existing methods and commercial antivirus software.

Detection of Obfuscated Malicious JavaScript Code

Websites on the Internet are becoming increasingly vulnerable to malicious JavaScript code because of its strong impact and dramatic effect. Numerous recent cyberattacks use JavaScript vulnerabilities, and in some cases employ obfuscation to conceal their malice and elude detection. To secure Internet users, an adequate intrusion-detection system (IDS) for malicious JavaScript must be developed. This paper proposes an automatic IDS of obfuscated JavaScript that employs several features and machine-learning techniques that effectively distinguish malicious and benign JavaScript codes. We also present a new set of features, which can detect obfuscation in JavaScript. The features are selected based on identifying obfuscation, a popular method to bypass conventional malware detection systems. The performance of the suggested approach has been tested on JavaScript obfuscation attacks. The studies have shown that IDS based on selected features has a detection rate of 94% for malicious samples and 81% for benign samples within the dimension of the feature vector of 60.

An Approach for Malicious JavaScript Detection Using Adaptive Taylor Harris Hawks Optimization-Based Deep Convolutional Neural Network

JavaScript has to become a pervasive web technology that facilitates interactive and dynamic Web sites. The extensive usage and the properties permit the authors to simply obfuscate the code and make JavaScript an interesting place for hackers. JavaScript is usually used for adding functionalities and improving the usage of web applications. Despite several merits and usages of JavaScript, the major issue is that several recent cyber-attacks like drive-by-download attacks utilized the susceptibility of JavaScript codes. This paper devises a novel technique for detecting malicious JavaScript. Here, JavaScript codes are fed to the feature extraction phase for extracting the noteworthy features that include execution time, function calls, conditional statements, break statements, and Boolean. The extracted features are further subjected to data transformation wherein log transformation is adapted to normalize the data. Then, feature selection is performed using mutual information.

JStrong: Malicious JavaScript detection based on code semantic representation and graph neural network

Web development technology has experienced significant progress. The creation of JavaScript has highly enriched the interactive ability of the client. However, the attacker uses the dynamic characteristics of the JavaScript language to embed malicious code into web pages to achieve the purpose of smuggling, redirection, and so on. Traditional methods based on static feature detection are therefore difficult to detect malicious code after confusion, and the method based on dynamic analysis is inefficient. To meet these challenges, this paper proposes a static detection model JStrong based on graph neural network. The model first generates an abstract syntax tree from the JavaScript source code, and then adds data flow and control flow information into the program dependency graph. In addition, we embed the nodes and edges of the graph into the feature vector and fully learn the features of the whole graph through the graph neural network. We take advantage of a real-world dataset collected from the top website and GitHub to evaluate JStrong and compare it to the state-of-the-art method. Experimental results show that JStrong achieves near-perfect classification performance and is superior to the state-of-the-art method.

Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods

Attacks using Uniform Resource Locators (URLs) and their JavaScript (JS) code content to perpetrate malicious activities on the Internet are rampant and continuously evolving. Methods such as blocklisting, client honeypots, domain reputation inspection, and heuristic and signature-based systems are used to detect these malicious activities. Recently, machine learning approaches have been proposed; however, challenges still exist. First, blocklist systems are easily evaded by new URLs and JS code content, obfuscation, fast-flux, cloaking, and URL shortening. Second, heuristic and signature-based systems do not generalize well to zero-day attacks. Third, the Domain Name System allows cybercriminals to easily migrate their malicious servers to hide their Internet protocol addresses behind domain names. Finally, crafting fully representative features is challenging, even for domain experts. This study proposes a feature selection and classification approach for malicious JS code content using Shapley additive explanations and tree ensemble methods. The JS code features are obtained from the Abstract Syntax Tree form of the JS code, sample JS attack codes, and association rule mining. The malicious and benign JS code datasets obtained from Hynek Petrak and the Majestic Million Service were used for performance evaluation. We compared the performance of the proposed method to those of other feature selection methods in the task of malicious JS code content detection. With a recall of 0.9989, our experimental results show that the proposed approach is a better prediction model.

Malicious Javascript Detection based on Clustering Techniques

Malicious JavaScript code is still a problem for website and web users. The complication and equivocation of this code make the detection which is based on signatures of antivirus programs becomes ineffective. So far, the alternative methods using machine learning have achieved encouraging results, and have detected malicious JavaScript code with high accuracy. However, according to the supervised learning method, the models, which are introduced, depend on the number of labeled symbols and require significant computational resources to activate. The rapid growth of malicious JavaScript is a real challenge to the solutions based on supervised learning due to the lacking of experience in detecting new forms of malicious JavaScript code. In this paper, we deal with the challenge by the method of detecting malicious JavaScript based on clustering techniques. The known symbols that will be analyzed, the characteristics which are extracted, and a detection processing technique applied on output clusters are included in the model. This method is not computationally complicated, as well as the typical case experiments gave positive results; specifically, it has detected new forms of malicious JavaScript code.

Taylor–HHO algorithm: A hybrid optimization algorithm with deep long short‐term for malicious JavaScript detection

The security of information has become a major issue due to the development of network information-based technologies. The malicious script, like, JavaScript, is a major threat to computer networks in terms of network security. Here, the JavaScript allows the programmers not only to build advanced client-side interfaces for web-based applications but also utilized for carrying out attacks that may steal the user's confidential data. In addition, the attackers can easily induce malicious JavaScript into webpages for implanting attacks, like, phishing, spreading viruses, and Trojan horses. This paper devises a novel method, namely, Taylor–Harris Hawks Optimization driven deep long short-term memory (Taylor–HHO-based Deep LSTM) for malicious JavaScript discovery. Initially, the JavaScript is subjected as input to feature extraction in which certain features, such as time of execution, function calls, condition statement, break statement, loop statements, Boolean, number of lines, and number of O(N2) loops, are extracted. The obtained features are fed to transformation, wherein log transformation is applied for data transformation. The obtained transformed features are fused using information gain and Deep LSTM. Furthermore, the proposed Taylor–HHO-based Deep LSTM is employed for discovering malevolent JavaScript. The proposed Taylor–HHO-based Deep LSTM provided enhanced performance with the highest accuracy of 0.955, minimal FPR of 0.059, and highest TPR of 0.967.

Vulnerabilities in Android webview objects: Still not the end!

WebView objects allow Android apps to render web content in the app context. More specifically, in Android hybrid apps (i.e., those having both Android code and web code) the web content can interact with the underlying Android framework through Java interfaces and WebViewClient objects. Thus, while rendering web content a hybrid app can execute malicious Javascript code that can access the sensitive data on the device, bypassing the sandbox model usually adopted by standalone browsers. Researchers already analyzed the security issues of WebView objects, by focusing on Javascript interfaces. However, we believe that there are other aspects related to the rendering of web content in Android apps, such as WebViewClient objects, that could lead to security issues.In this paper, we introduce three new types of vulnerabilities related to WebView, that expose new attack surfaces concerning the most well-known vulnerability related to JavaScript interfaces. To detect these new types of vulnerabilities, we designed WebVSec, a static analysis system that relies on a set of custom inference rules, heuristically formalized. By designing WebVSec to detect also the vulnerability already described in the state-of-art, we were able to compare WebVSec with BabelView on a set of 2000 applications. BabelView was found not able to detect our new three types of vulnerabilities and also less precise and efficient in detecting the already known vulnerability. In particular, over the 2000 analyzed apps, WebVSec and BabelView identified 48 and 18 vulnerable apps, respectively. Among those, WebVSec found 20 apps having a specific type of vulnerabilities and 36 apps having another type of vulnerabilities, while BabelView found 11 and 0 apps, respectively. In terms of efficiency, WebVSec took 27.16 hours to analyze the whole set of 2000 applications against the 63.64 hours required by BabelView.

Spider bird swarm algorithm with deep belief network for malicious JavaScript detection

JavaScript is employed in vast scenarios like web applications, NodeJS, and hybrid-mobile applications. Moreover, JavaScript is a core component in the social network because of its outstanding cross-platform. However, the flexibility of JavaScript made these applications more prone to attacks that induce malicious behaviors in the code. This paper proposes a hybrid optimization model, namely the Spider-based Bird swarm algorithm (S-BSA) algorithm for malicious JavaScript detection. The proposed S-BSA is designed by the integration of Spider Monkey Optimization (SMO) and Bird Swarm algorithm (BSA). The attributes like Boolean, execution time, function calls, break statements, and conditional statements are considered from the datasets. After the extraction of features, Box-Cox transformation is applied to normalize data. Moreover, a Deep belief network (DBN) is employed to classify normal and malicious JavaScript codes. The classification is progressed with DBN, wherein the training of DBN is performed with the proposed S-BSA. The proposed S-BSA algorithm outperformed other methods with maximal accuracy of 0.944, maximal TPR of 0.958, and minimal FPR of 0.081.

JSContana: Malicious JavaScript detection using adaptable context analysis and key feature extraction

JavaScript has played a crucial role in web development, making it a primary tool for hackers to launch assaults. Although malicious JavaScript detection methods are becoming increasingly effective, the existing methods based on feature matching or static word embeddings are difficult to detect different versions and obfuscation of JavaScript code. To solve this problem, we present JSContana, a novel detection method that consists of adaptable context analysis and efficient key feature extraction. The key to our approach is context analysis based on dynamic word embeddings. We convert JavaScript code to syntax unit sequences with detailed information and get the real contextual representation of code by dynamic word embeddings. Furthermore, as a classification module in the method, TextCNN can effectively extract key features. To demonstrate the performance of the method, we have conducted extensive comparison experiments under five-fold cross-validation. Numerical results show that the method achieves 0.990 in AUC-score, and outperforms the state-of-the-art method by up to 3.5%.

Detection of malicious javascript on an imbalanced dataset

In order to be able to detect new malicious JavaScript with low cost, methods with machine learning techniques have been proposed and gave positive results. These methods focus on achieving a light-weight filtering model that can quickly and precisely filter out malicious data for dynamic analysis. A method constructs a language model using Natural Language Processing techniques to represent the data in vector form from the source code for machine learning. This method has high score with the balanced dataset, however the experiment with an imbalanced dataset has not been done. Previous studies mainly focus on a balanced dataset, however the dataset is not representative of real-world data, and it rises questions in practical uses of the model. A good model that can have a high recall score with imbalanced dataset is needed for a good filter. To construct an efficient language model, and to deal with the data imbalance problem, we focus on oversampling techniques. In our research, our method is the first to use oversampling and machine learning to detect malicious JavaScript. The experimental result shows that our method can detect new malicious JavaScript more accurately and efficiently. Our model can quickly filter out malicious data for dynamic analysis. The best recall score achieves 0.72 with the Doc2Vec model. Our proposed method is shown to outperform the baseline method by 210% in terms of recal score with the same training time and test time per sample.

Adaptive Spider Bird Swarm Algorithm-Based Deep Recurrent Neural Network for Malicious JavaScript Detection Using Box-Cox Transformation

JavaScript is a scripting language that is commonly used in the web pages for providing dynamic functionality in order to enhance user experience. Malicious JavaScript in webpages on internet is an important security issue due to their potentially and universality severe impact. Finding the malicious JavaScript is usually more difficult and time-consuming task in the research community. Hence, an adaptive spider bird swarm algorithm-based deep recurrent neural network (adaptive SBSA-based deep RNN) is proposed for detecting the malicious JavaScript codes in web applications. However, the proposed adaptive SBSA is designed by integrating the adaptive concept with the bird swarm algorithm (BSA) and spider monkey optimization (SMO). With the deep RNN classifier, the complexity issues exists in detecting the malicious codes is effectively resolved through the process of hierarchical computation. Due to the efficiency of the proposed approach, it can evaluate under large real-life datasets.

Deobfuscation, unpacking, and decoding of obfuscated malicious JavaScript for machine learning models detection performance improvement

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi-layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD-preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.

Malicious JavaScript Detection Based on Bidirectional LSTM Model

JavaScript has been widely used on the Internet because of its powerful features, and almost all the websites use it to provide dynamic functions. However, these dynamic natures also carry potential risks. The authors of the malicious scripts started using JavaScript to launch various attacks, such as Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), and drive-by download attack. Traditional malicious script detection relies on expert knowledge, but even for experts, this is an error-prone task. To solve this problem, many learning-based methods for malicious JavaScript detection are being explored. In this paper, we propose a novel deep learning-based method for malicious JavaScript detection. In order to extract semantic information from JavaScript programs, we construct the Program Dependency Graph (PDG) and generate semantic slices, which preserve rich semantic information and are easy to transform into vectors. Then, a malicious JavaScript detection model based on the Bidirectional Long Short-Term Memory (BLSTM) neural network is proposed. Experimental results show that, in comparison with the other five methods, our model achieved the best performance, with an accuracy of 97.71% and an F1-score of 98.29%.

Detecting malicious JavaScript code based on semantic analysis

Web development technology has undergone tremendous evolution, the creation of JavaScript has greatly enriched the interactive capabilities of the client. However, attackers use the dynamics feature of JavaScript language to embed malicious code into web pages for the purpose of drive-by-download, redirection, etc. The traditional method based on static feature detection is difficult to detect the malicious code after obfuscation, and the method based on dynamic analysis has low efficiency. To overcome these challenges, this paper proposes a static detection model based on semantic analysis. The model firstly generates an abstract syntax tree from JavaScript source codes, then automatically converts them to syntactic unit sequences. FastText algorithm is introduced to training word vectors. The syntactic unit sequences are represented as word vectors which will be input into Bi-LSTM network with attention mechanism. The detection model with Bi-LSTM network with attention mechanism is the key to detect malicious JavaScript. We experimented with the dataset using a five-fold cross-validation method. Experiments showed that the model can effectively detect obfuscated malicious JavaScript code and improve the detection speed, with a precision of 0.977 and recall of 0.974.

A Survey on Current Malicious JavaScript Behavior of infected Web Content in Detection of Malicious Web pages

In recent years, the advance growth of cybercrime has become an urgent issue to the security authorities. With the improvement of web technologies enable attackers to launch the web-based attacks and other malicious code easily without having prior expert knowledge. Recently, JavaScript has become the most common attack construction language as it is the primary browser scripting language which allow developer to develop sophisticated client-side interfaces for web application. This lead to the growth of malicious websites and as main platform for distributing malware or malicious script to the user’s computer when the user access to these webpages. Initial act and detection on such threats early in a timely manner is vital in order to reduce the damages which have caused billions of dollars lost every year. A number of approaches have been proposed to detect malicious web pages. However, the efficient detection of malicious web pages previously has generated many false alarm by the use of sophisticated obfuscation techniques in benign JavaScript code in web pages. Therefore, in this paper, a thoroughly survey and detailed understanding of malicious JavaScript code features will be provided, which have been collected from the web content. We conduct a thorough analysis and studies on the usage of different JavaScript features and JavaScript detection technique systematically and present the most important features of malicious threats in web pages. Then the analysis will be presented along with different dimensions (features representation, detection techniques analysis, and sample of malicious script).

Nested context-aware sanitisation and feature injection in clustered templates of JavaScript worms on the cloud-based OSN

This article presents an enhanced JavaScript feature-injection based framework that obstructs the execution of cross-site scripting (XSS) worms from the virtual machines of cloud-based online social network (OSN). It calculates the features of clustered-sanitised compressed templates of JavaScript attack vectors embedded in the HTTP response messages. Any variation observed in such JavaScript feature set indicates the injection of XSS worms on the cloud-based OSN server. The injected worms will further undergo through the process of nested context-aware sanitisation for its safe interpretation on the web browser. The prototype of our framework was developed in Java and installed in the virtual machines of cloud environment. The experimental evaluation of our framework was performed on the platform of OSN-based web applications deployed in the cloud platform. The performance analysis done revealed that our framework detects the injection of malicious JavaScript code with low false negative rate and acceptable performance overhead.

Nested context-aware sanitisation and feature injection in clustered templates of JavaScript worms on the cloud-based OSN

This article presents an enhanced JavaScript feature-injection based framework that obstructs the execution of cross-site scripting (XSS) worms from the virtual machines of cloud-based online social network (OSN). It calculates the features of clustered-sanitised compressed templates of JavaScript attack vectors embedded in the HTTP response messages. Any variation observed in such JavaScript feature set indicates the injection of XSS worms on the cloud-based OSN server. The injected worms will further undergo through the process of nested context-aware sanitisation for its safe interpretation on the web browser. The prototype of our framework was developed in Java and installed in the virtual machines of cloud environment. The experimental evaluation of our framework was performed on the platform of OSN-based web applications deployed in the cloud platform. The performance analysis done revealed that our framework detects the injection of malicious JavaScript code with low false negative rate and acceptable performance overhead.

Hybrid Optimization Driven Technique for Malicious Javascript Detection Based on Deep Learning Classifier

The growth of the web users and thecontents are increasing in a daily basis. In all these webpages the implementation of javascripts are a common factor. These scripts are used for the simplicity and achieve interaction with the user, but, also could be used to harm the end user by stealing information, redirecting to phishing pages and installing harmful softwares. This alarms an immediate look into the security concerns of the javascript. There exist many machine learningbased malicious script detection approaches, but majority of them follow a shallow discriminating models where manual definition of features are constructed with artificial rules. In this paper, a deep learning framework for detecting malicious JavaScript code is proposed combing the optimization power of Bird Swarm Algorithm. To extract high-level features from JavaScript code Stacked denoising auto-encoders are implemented and BSA is used to optimise the features and identify the malicious codes. The theoretical model [2] have an accuracy of 94% in identifying the malicious codes.