Malicious Scripts Research Articles

MPSAutodetect: A Malicious Powershell Script Detection Model Based on Stacked Denoising Auto-Encoder

PowerShell is an important tool used to automate administrative tasks. It is an open-source tool that is pre-installed on Windows machines and is accessible on many other operating systems. Administrators generally utilize PowerShell to carry out a range of typical management tasks, such as adding and deleting accounts, editing groups, and accessing hard-to-find user information. However, researchers recently found that PowerShell was used to execute various attacks. These attacks leveraged PowerShell’s vast number of properties to access privileged information, gain control of entire machines or spread over an organization. Because of the obfuscation and complex natures of these malicious scripts, detection is costly and difficult. Here, we present Malicious PowerShell Script Autodetect (MPSAutodetect), a detection model that relies on machine learning techniques to detect malicious PowerShell scripts. Our model was built with the use of stacked denoising auto-encoders (SdAs) to extract meaningful features. These valuable, easily attained features were fed to the eXtreme gradient boosting (XGBoost) classifier. Two substantial datasets (labelled and unlabelled) were collected to train and test MPSAutodetect in supervised and semi-supervised manners. The dataset contained malicious and benign obfuscated scripts. The results showed that regardless of the features extracted from the SdA, the supervised approach resulted in better detection, with a significant 98% true-positive rate and a low 0.6% false-positive rate. Thus, the analysis of MPSAutodetect showed that the model achieves respectable performance without the hassling process of manual feature engineering.

WTA: A Static Taint Analysis Framework for PHP Webshell

Webshells are a malicious scripts that can remotely control a webserver to execute arbitrary commands, steal sensitive files, and further invade the internal network. Existing webshell detection methods, such as using pattern matching for webshell detection, can be easily bypassed by attackers using the file include and user-defined functions. Furthermore, detecting unknown webshells has always been a problem in the field of webshell detection. In this paper, we propose a static webshell detection method based on taint analysis, which realizes accurate taint analysis based on ZendVM. We first converted the PHP code into Opline sequences, analyzed the Opline sequences in order, and marked the externally imported taint source. Then, the propagation of the taint variables was tracked, and the interprocedural analysis of the taint variables was performed. Finally, considering the dangerous functions’ call and the referencing of the taint variables at the point of the taint sink, we completed the webshell judgment. Based on this method, we constructed a taint analysis prototype system named WTA and evaluated it with a benchmark dataset by comparing its performance with popular webshell detection tools. The results showed that our method supports interprocedural analysis and has the ability to detect unknown webshells and that WTA’s performance surpasses well-known webshell detection tools such as D-shield, SHELLPUB, WebshellKiller, CloudWalker, ClamAV, LoKi, and findbot.pl.

Server Side Method to Detect and Prevent Stored XSS Attack

Cross-Site Scripting (XSS) is one of the most common and dangerous attacks. The user is the target of an XSS attack, but the attacker gains access to the user by exploiting an XSS vulnerability in a web application as Bridge. There are three types of XSS attacks: Reflected, Stored, and Dom-based. This paper focuses on the Stored-XSS attack, which is the most dangerous of the three. In Stored-XSS, the attacker injects a malicious script into the web application and saves it in the website repository. The proposed method in this paper has been suggested to detect and prevent the Stored-XSS. The prevent Stored-XSS Server (PSS) was proposed as a server to test and sanitize the input to web applications before saving it in the database. Any user input must be checked to see if it contains a malicious script, and if so, the input must be sanitized and saved in the database instead of the harmful input. The PSS is tested using a vulnerable open-source web application and succeeds in detection by determining the harmful script within the input and prevent the attack by sterilized the input with an average time of 0.3 seconds.

Taylor–HHO algorithm: A hybrid optimization algorithm with deep long short‐term for malicious JavaScript detection

The security of information has become a major issue due to the development of network information-based technologies. The malicious script, like, JavaScript, is a major threat to computer networks in terms of network security. Here, the JavaScript allows the programmers not only to build advanced client-side interfaces for web-based applications but also utilized for carrying out attacks that may steal the user's confidential data. In addition, the attackers can easily induce malicious JavaScript into webpages for implanting attacks, like, phishing, spreading viruses, and Trojan horses. This paper devises a novel method, namely, Taylor–Harris Hawks Optimization driven deep long short-term memory (Taylor–HHO-based Deep LSTM) for malicious JavaScript discovery. Initially, the JavaScript is subjected as input to feature extraction in which certain features, such as time of execution, function calls, condition statement, break statement, loop statements, Boolean, number of lines, and number of O(N2) loops, are extracted. The obtained features are fed to transformation, wherein log transformation is applied for data transformation. The obtained transformed features are fused using information gain and Deep LSTM. Furthermore, the proposed Taylor–HHO-based Deep LSTM is employed for discovering malevolent JavaScript. The proposed Taylor–HHO-based Deep LSTM provided enhanced performance with the highest accuracy of 0.955, minimal FPR of 0.059, and highest TPR of 0.967.

LSTM RNN: detecting exploit kits using redirection chain sequences

While consumers use the web to perform routine activities, they are under the constant threat of attack from malicious websites. Even when visiting ‘trusted’ sites, there is always a risk that site is compromised, and, hosting a malicious script. In this scenario, the injected script would typically force the victim’s browser to undergo a series of redirects before reaching an attacker-controlled domain, which, delivers the actual malware. Although these malicious redirection chains aim to frustrate detection and analysis efforts, they could be used to help identify web-based attacks. Building upon previous work, this paper presents the first known application of a Long Short-Term Memory (LSTM) network to detect Exploit Kit (EK) traffic, utilising the structure of HTTP redirects. Samples are processed as sequences, where each timestep represents a redirect and contains a unique combination of 48 features. The experiment is conducted using a ground-truth dataset of 1279 EK and 5910 benign redirection chains. Hyper-parameters are tuned via K-fold cross-validation (5f-CV), with the optimal configuration achieving an F1 score of 0.9878 against the unseen test set. Furthermore, we compare the results of isolated feature categories to assess their importance.

HANDLING VULNERABLE SCRIPT CODE IN WEB ENGINEERING

Abstract- Network protection in our everyday lives is becoming increasingly critical today. Since we cannot live without the Internet, it is important to have a good and security environment for networking. Cross site scripting (XSS) does, however, attack millions of websites. We can use XSS to insert malicious scripting code into apps and then return it to the customer side. If users are using the web browser to visit the injecting place of the malicious script code, it is directly run on the customer machine. The main words of XSS are commonly found in the JavaScript browser or on the server component to filter malicious code. However, it is difficult to collect all keywords in the detecting-list in order to prevent XSS attack. However, it is possible to create various forms of malicious scripting. It is also worthwhile for more people to work on XSS and find more ways to prevent XSS attacks.

Ontology for Cross-Site-Scripting (XSS) Attack in Cybersecurity

In this work, we tackle a frequent problem that frequently occurs in the cybersecurity field which is the exploitation of websites by XSS attacks, which are nowadays considered a complicated attack. These types of attacks aim to execute malicious scripts in a web browser of the client by including code in a legitimate web page. A serious matter is when a website accepts the “user-input” option. Attackers can exploit the web application (if vulnerable), and then steal sensitive data (session cookies, passwords, credit cards, etc.) from the server and/or from the client. However, the difficulty of the exploitation varies from website to website. Our focus is on the usage of ontology in cybersecurity against XSS attacks, on the importance of the ontology, and its core meaning for cybersecurity. We explain how a vulnerable website can be exploited, and how different JavaScript payloads can be used to detect vulnerabilities. We also enumerate some tools to use for an efficient analysis. We present detailed reasoning on what can be done to improve the security of a website in order to resist attacks, and we provide supportive examples. Then, we apply an ontology model against XSS attacks to strengthen the protection of a web application. However, we note that the existence of ontology does not improve the security itself, but it has to be properly used and should require a maximum of security layers to be taken into account.

Intelligent Attack Detection Modelin lotusing Optimal Feature Selectionincorporated withOptimized DeepLearningArchitecture

Attacks and problem recognition within the Internet of Things (IoT) foundation is an increasing worry in the environment of IoT.Within the expanded utilization of IoT framework in each space, dangers and assaults in these foundations are additionally developing comparably. Some attacks like node tampering, malicious code injection, malicious node injection, DoS Attacks, Malicious scripts such assaults and inconsistencies which can cause an IoT framework failure. In this study deep learning architecture models were compared to attacks and anamolies on the IoT frameworks that could be predicted.Themainphases ofthe proposedanomalyorattackdetection model are Feature Extractionand Detection. Infeatureextractionprocess,the attributesinthe datasetisconsideredasfeatures,which arelike SystemID,SystemAddress,SystemType,SystemLocation,DestinationService Address,DestinationServiceType,DestinationLocation,Accessed NodeAddress,Accessed Node Type, Operation, Value, Timestamp, and Normality. Since thenumbersoffeatureare high,which increasesthe lengthofthefeature vector, optimalfeatureselectionprocesswillbedevelopedtoextractthe mostsignificantfeatures withuni.queinformation.Finally,theoptimizedDBN(Deep Belief Network)categorizesthedataintonormalas wellasattacks,anddetectseachcategoryofattacks.

A Secure Methodology to Detect and Prevent Ddos and Sql Injection Attacks

As most of the applications host on cloud, Security is a major concern for the data owners. The cloud environment has to be secure and protect data owner data from cloud attacks. In this project work, we study about securing firewall against client side attacks namely Denial of firewall and SQL injection attacks. Denial of firewall is nothing but overloading the firewall by bursting n number of requests through vulnerable scripts. SQL injection attack is defined as bypassing the security protocols by malicious scripts. Thus we proposed to design and develop a web application to detect and prevent denial of firewall and SQL injection attacks.
 The denial of firewall attack can be performed using Java environment based servers and prevention can be performed using Digital Signature Algorithm (DSA) in which filter based approach and software puzzle based approach are performed to detect the malicious script based requests. Once the Deep Packet Inspection (DPI): filter based approach and software puzzle based approach are find satisfactory only the request would be processed. If the request is find malicious automatically the requested IP address would be blocked. Various type of SQL injection attacks namely SQL login bypass, Blind injection, SQL sleep attack, Data fetching attack are analysed and performed. The SQL injection attack can be prevented using PREPARE statements. This statements are created to make the SQL queries more efficient and render security benefits. This statement provides effective prevention mechanism against SQL injection attacks. Thus our proposed solution, provides high security against firewall attacks namely denial of firewall and SQL injection securing the data owner files and preventing compromising of firewall

Effective method for detecting malicious PowerShell scripts based on hybrid features☆

At present, network attacks are rampant in the Internet world, and the attack methods of hackers are changing steadily. PowerShell is a programming language based on the command line and.NET framework, with powerful functions and good compatibility. Therefore, hackers often use PowerShell malicious scripts to attack the victims in APT attacks. When these malicious PowerShell scripts are executed, hackers can control the victim’s computer or leave a backdoor on their computers. In this paper, a detection model of malicious PowerShell scripts based on hybrid features is proposed, we analyzed the differences between malicious and benign samples in text characters, functions, tokens and the nodes of the abstract syntax tree. Firstly, the script of PowerShell is embedded by FastText. Then the textual features, token features and the nodes features of PowerShell code extracted from the abstract syntax tree are added. Finally, the hybrid features of scrips will be classified by a Random Forest classifier. In the experiment, the malicious scripts are inserted into the benign scripts to weaken the features of the malicious samples in the level of abstract syntax tree nodes and tokens, which makes the scripts more complex. Even in such a complex data set, the proposed model which is based on hybrid features still achieves an accuracy of 97.76% in fivefold cross-validation. Moreover, the accuracy of this proposed model on the original scripts is 98.93%, which means that the proposed model has the ability to classify complex scripts.

Automatic Reverse Engineering of Script Engine Binaries for Building Script API Tracers

Script languages are designed to be easy-to-use and require low learning costs. These features provide attackers options to choose a script language for developing their malicious scripts. This diversity of choice in the attacker side unexpectedly imposes a significant cost on the preparation for analysis tools in the defense side. That is, we have to prepare for multiple script languages to analyze malicious scripts written in them. We call this unbalanced cost for script languages asymmetry problem . To solve this problem, we propose a method for automatically detecting the hook and tap points in a script engine binary that is essential for building a script Application Programming Interface (API) tracer. Our method allows us to reduce the cost of reverse engineering of a script engine binary, which is the largest portion of the development of a script API tracer, and build a script API tracer for a script language with minimum manual intervention. This advantage results in solving the asymmetry problem. The experimental results showed that our method generated the script API tracers for the three script languages popular among attackers (Visual Basic for Applications (VBA), Microsoft Visual Basic Scripting Edition (VBScript), and PowerShell). The results also demonstrated that these script API tracers successfully analyzed real-world malicious scripts.

Prevention of XSS attack using Cryptography & API integration with Web Security

The vulnerability of web-based applications has increased manifold primarily due to the ever-increasing time spent on the web. Cross site scripting (XSS) attack are one of the most prominent attacks that are executed when the attacker get success over API key authentication and successfully execute their malicious script code at server end. Of the two types of XSS that are popular in the hacking world i.e. server side XSS and client side XSS, server-side attacks are more frequent and vulnerable. Various methodologies have been developed in the recent past to handle XSS attacks API authentication based techniques, handling access at server end etc. However, these methodologies suffer from one or more limitation of handling the attack from one perspective. In this paper, we demonstrate a multi-layer prevention technique wherein we defend the attacker hit at API key authentication level using an encrypted that prevents the attacker easy access to API directly. In the next layer we convert the script code execution request into plain text which is coming from any untrusted party, so that plain text will not execute over browser. Thus, our proposed framework provides an effective solution to protect our environment from XSS attacks.

A Web Shell Detection Method Based on Multiview Feature Fusion

Web shell is a malicious script file that can harm web servers. Web shell is often used by intruders to perform a series of malicious operations on website servers, such as privilege escalation and sensitive information leakage. Existing web shell detection methods have some shortcomings, such as viewing a single network traffic behavior, using simple signature comparisons, and adopting easily bypassed regex matches. In view of the above deficiencies, a web shell detection method based on multiview feature fusion is proposed based on the PHP language web shell. Firstly, lexical features, syntactic features, and abstract features that can effectively represent the internal meaning of web shells from multiple levels are integrated and extracted. Secondly, the Fisher score is utilized to rank and filter the most representative features, according to the importance of each feature. Finally, an optimized support vector machine (SVM) is used to establish a model that can effectively distinguish between web shell and normal script. In large-scale experiments, the final classification accuracy of the model on 1056 web shells and 1056 benign web scripts reached 92.18%. The results also surpassed well-known web shell detection tools such as VirusTotal, ClamAV, LOKI, and CloudWalker, as well as the state-of-the-art web shell detectionmethods.

New biostatistics features for detecting web bot activity on web applications

Web bots are malicious scripts that automatically traverse the websites, fill the web form and illegally scrap the data from web sites. The never-ending threat of web bot is causing serious problems on the web applications. According to various web bot traffic reports, more than fifty percent of the total web traffic is coming from web bots. An effective safeguard against automated web bots is to detect the human user presence on the web applications. Most part of the existing research is focused on specific web bot detection such as form spamming bot, data scrapping bots, chat bots, and game bots. In this paper, the web bot detection model is proposed using combined supervised and unsupervised machine learning algorithms. In this paper, new Biostatistics features are proposed which is used to identify the human user presence on web applications. The Biostatistics features have proven very effective in discriminating human users from general web bots. Various attack scenarios are created for web bot attacks such as automated account registration, automatic form filling, and data scrapping to mimic the zero-day web bot attacks. The proposed model is evaluated by numerous experiments using standard evaluation parameters. The result analysis reveals that the proposed model is efficient in discriminating human users from web bots.

Malicious JavaScript Detection Based on Bidirectional LSTM Model

JavaScript has been widely used on the Internet because of its powerful features, and almost all the websites use it to provide dynamic functions. However, these dynamic natures also carry potential risks. The authors of the malicious scripts started using JavaScript to launch various attacks, such as Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), and drive-by download attack. Traditional malicious script detection relies on expert knowledge, but even for experts, this is an error-prone task. To solve this problem, many learning-based methods for malicious JavaScript detection are being explored. In this paper, we propose a novel deep learning-based method for malicious JavaScript detection. In order to extract semantic information from JavaScript programs, we construct the Program Dependency Graph (PDG) and generate semantic slices, which preserve rich semantic information and are easy to transform into vectors. Then, a malicious JavaScript detection model based on the Bidirectional Long Short-Term Memory (BLSTM) neural network is proposed. Experimental results show that, in comparison with the other five methods, our model achieved the best performance, with an accuracy of 97.71% and an F1-score of 98.29%.

A Survey on Current Malicious JavaScript Behavior of infected Web Content in Detection of Malicious Web pages

In recent years, the advance growth of cybercrime has become an urgent issue to the security authorities. With the improvement of web technologies enable attackers to launch the web-based attacks and other malicious code easily without having prior expert knowledge. Recently, JavaScript has become the most common attack construction language as it is the primary browser scripting language which allow developer to develop sophisticated client-side interfaces for web application. This lead to the growth of malicious websites and as main platform for distributing malware or malicious script to the user’s computer when the user access to these webpages. Initial act and detection on such threats early in a timely manner is vital in order to reduce the damages which have caused billions of dollars lost every year. A number of approaches have been proposed to detect malicious web pages. However, the efficient detection of malicious web pages previously has generated many false alarm by the use of sophisticated obfuscation techniques in benign JavaScript code in web pages. Therefore, in this paper, a thoroughly survey and detailed understanding of malicious JavaScript code features will be provided, which have been collected from the web content. We conduct a thorough analysis and studies on the usage of different JavaScript features and JavaScript detection technique systematically and present the most important features of malicious threats in web pages. Then the analysis will be presented along with different dimensions (features representation, detection techniques analysis, and sample of malicious script).

Hybrid Optimization Driven Technique for Malicious Javascript Detection Based on Deep Learning Classifier

The growth of the web users and thecontents are increasing in a daily basis. In all these webpages the implementation of javascripts are a common factor. These scripts are used for the simplicity and achieve interaction with the user, but, also could be used to harm the end user by stealing information, redirecting to phishing pages and installing harmful softwares. This alarms an immediate look into the security concerns of the javascript. There exist many machine learningbased malicious script detection approaches, but majority of them follow a shallow discriminating models where manual definition of features are constructed with artificial rules. In this paper, a deep learning framework for detecting malicious JavaScript code is proposed combing the optimization power of Bird Swarm Algorithm. To extract high-level features from JavaScript code Stacked denoising auto-encoders are implemented and BSA is used to optimise the features and identify the malicious codes. The theoretical model [2] have an accuracy of 94% in identifying the malicious codes.

Malicious Traffic Detection System using Publicly Available Blacklist’s

In this fastest growing technology with the increase in internet usage, the communication became much faster and easier which resulted in the massive growth in digitalization. With this the cyber crimes were increasing day-by-day . They employ every possible technique and trick to make the users as zombies for their malicious activities or Crypto mining. In recent years we are facing issues with ransomware’ which result in the loss of data integrity and confidentiality along with our privacy and anonymity. The malware’ can spread all over the network within no time. Using anti virus programs alone for safeguarding our network is a bad practice because they filter the traffic on signature based. Here problem is if the user is not up to date with the definitions from the AV provider, then he will be prone to the attack. In this model a system to track malicious trails in a network is done. This employs online malware detection system (Virus Total) and open source dynamic black lists which contain malware or suspicious programs along with some static pre compiled blacklists from different antivirus providers and our own definitions of block to filter the traffic which gives the detailed log report on the suspicious trails, this is from domain name or IP address or malicious scripts in the webpage.

SEC‐H5: Secure and efficient integration of settings of enhanced HTML5 XSS vector defensive framework on edge network of fog nodes

SummaryThe authors introduce an enhanced HTML5 (H5) Cross‐Site Scripting (H5‐XSS) attack vector defensive model that safeguards and maintains the confidentiality of users accessing the web applications hosted on the fog nodes. Initially, the model performs in self‐training manner and estimates some features of H5 script code at the simulated desktop host systems of cloud infrastructure. Second, a process of H5 feature estimation gets re‐executed for the online generated HTTP response on the edge network of fog device. Any oddity in these two features sets results in the consequent nested context‐familiar sanitization of the distrustful script code on an installed fog nodes. The author design their framework structure on an open application infrastructural structure of Cisco IOx framework of various networked edge devices as fog nodes. The authors configure the tested bed of H5 web platforms on the nodes of the fog computing network for evaluating the malicious script alleviation capability of their model. Evaluation outcomes expose that the author's technique is skilled sufficient for sensing and excluding the suspicious H5 code with sufferable percentage of False Negatives (FNs), False Positives (FPs), and reduced overall performance overhead during the peak congestion of generation of sanitized HTTP response on the fog nodes.

Web Application Security: An Investigation on Static Analysis with other Algorithms to Detect Cross Site Scripting

Among web application vulnerabilities, XSS is the most frequently occurring. Where a web application accepts a user-input, it is possible for such vulnerability to inject malicious scripts. The greater part of the literature concentrated on the application of static analysis in order to locate XSS vulnerabilities. The reason for this is its capability of achieving effectively a 100 percent code coverage and observing every path of the program. Nevertheless, the main restriction of static analysis, being the false positive rate shown in the results, continues. Consequently, researchers began to merge static analysis with other algorithms, such as genetic algorithm, machine learning and pattern matching. This is to improve the XSS detection results as well as the static analysis run time. This essay defines the algorithms which formerly improved the static analysis outcomes regarding XSS vulnerability detection. Furthermore, each method’s restriction was mentioned in which the studies continue to lack an efficient detection of XSS vulnerability in PHP web application.