A Static Malicious Javascript Detection Using SVM

Wang, Weihong; Lv, Yin-Jun; Chen, Hui-Bing; Fang, Zhaolin

doi:10.2991/iccsee.2013.56

Cited by 23 publications

(10 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our proposed system uses an LSTM neural model for the language model instead of the n-gram model proposed by Shah [33]. Other papers which investigate the detection of malicious JavaScript include [26], [32], [35], [38], [39].…”

Section: Related Workmentioning

confidence: 99%

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Stokes

Agrawal

McDonald

et al. 2019

MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)

View full text Add to dashboard Cite

Malicious scripts are an important computer infection threat vector in the wild. For web-scale processing, static analysis offers substantial computing efficiencies. We propose the ScriptNet system for neural malicious JavaScript detection which is based on static analysis. We use the Convoluted Partitioning of Long Sequences (CPoLS) model, which processes Javascript files as byte sequences. Lower layers capture the sequential nature of these byte sequences while higher layers classify the resulting embedding as malicious or benign. Unlike previously proposed solutions, our model variants are trained in an end-to-end fashion allowing discriminative training even for the sequential processing layers. Evaluating this model on a large corpus of 212,408 JavaScript files indicates that the best performing CPoLS model offers a 97.20% true positive rate (TPR) for the first 60K byte subsequence at a false positive rate (FPR) of 0.50%. The best performing CPoLS model significantly outperform several baseline models.

show abstract

Section: Related Workmentioning

confidence: 99%

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Stokes

Agrawal

McDonald

et al. 2019

MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)

View full text Add to dashboard Cite

show abstract

“…JavaScript is a good choice for attackers to carry out their attacks and to spread them over the Internet, because the majority of websites use JavaScript and it is supported by all web browsers. Hence, it is the target of many XSS, SQL injection and passive download attacks [22].…”

Section: Javascriptmentioning

confidence: 99%

“…This approach has high accuracy, but depends on a single source for malicious scripts and again focuses on obfuscated scripts. Another study analyzing malicious scripts and feature extraction was conducted by Wang et al [22] where the main idea of feature extraction is that some functions are of limited use in the benign scripts, but are used much more in malicious scripts, such as the DOM-modifying functions, the eval function, the escape function. This technique gives accuracy of up to 94.38%.…”

Section: Related Workmentioning

confidence: 99%

Detecting Cross-Site Scripting Attacks Using Machine Learning

Mereani

Howe

2018

The International Conference on Advanced Machine Learning Technologies and Applications (AMLTA2018)

View full text Add to dashboard Cite

Cross-site scripting (XSS) is one of the most frequently occurring types of attacks on web applications, hence is of importance in information security. XSS is where the attacker injects malicious code, typically JavaScript, into the web application in order to be executed in the user's browser. Identifying that a script is malicious is an important part of the defence of a web application. This paper investigates using SVM, k-NN and Random Forests to detect and limit these attacks, whether known or unknown, by building classifiers for JavaScript code. It demonstrated that using an interesting feature set combining language syntax and behavioural features results in classifiers that give high accuracy and precision on large real world data sets without restricting attention only to obfuscation.

show abstract

“…Our proposed system uses an LSTM neural model for the language model instead of the n-gram model proposed by Shah (2016). Other papers which investigate the detection of malicious JavaScript include Liu et al (2014); Schütt et al (2012); Wang et al (2013); Xu et al (2012Xu et al ( , 2013.…”

Section: Related Workmentioning

confidence: 99%

Neural Classification of Malicious Scripts: A study with JavaScript and VBScript

Stokes,

Agrawal,

McDonald

2018

Preprint

View full text Add to dashboard Cite

Malicious scripts are an important computer infection threat vector. Our analysis reveals that the two most prevalent types of malicious scripts include JavaScript and VBScript. The percentage of detected JavaScript attacks are on the rise. To address these threats, we investigate two deep recurrent models, LaMP (LSTM and Max Pooling) and CPoLS (Convoluted Partitioning of Long Sequences), which process JavaScript and VBScript as byte sequences. Lower layers capture the sequential nature of these byte sequences while higher layers classify the resulting embedding as malicious or benign. Unlike previously proposed solutions, our models are trained in an end-to-end fashion allowing discriminative training even for the sequential processing layers. Evaluating these models on a large corpus of 296,274 JavaScript files indicates that the best performing LaMP model has a 65.9% true positive rate (TPR) at a false positive rate (FPR) of 1.0%. Similarly, the best CPoLS model has a TPR of 45.3% at an FPR of 1.0%. LaMP and CPoLS yield a TPR of 69.3% and 67.9%, respectively, at an FPR of 1.0% on a collection of 240,504 VBScript files.

show abstract

A Static Malicious Javascript Detection Using SVM

Cited by 23 publications

References 5 publications

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Detecting Cross-Site Scripting Attacks Using Machine Learning

Neural Classification of Malicious Scripts: A study with JavaScript and VBScript

Contact Info

Product

Resources

About