Early detection of malicious behavior in JavaScript code

Abdullah

Wireless Communications and Mobile Computing

2017

The web application has become a primary target for cyber criminals by injecting malware especially JavaScript to perform malicious activities for impersonation. Thus, it becomes an imperative to detect such malicious code in real time before any malicious activity is performed. This study proposes an efficient method of detecting previously unknown malicious java scripts using an interceptor at the client side by classifying the key features of the malicious code. Feature subset was obtained by using wrapper method for dimensionality reduction. Supervised machine learning classifiers were used on the dataset for achieving high accuracy. Experimental results show that our method can efficiently classify malicious code from benign code with promising results.

Section: Introductionmentioning

confidence: 99%

Defending Malicious Script Attacks Using Machine Learning Classifiers

Abdullah

Wireless Communications and Mobile Computing

2017

MILCOM 2019 - 2019 IEEE Military Communications Conference (MILCOM)

“…Our proposed system uses an LSTM neural model for the language model instead of the n-gram model proposed by Shah [33]. Other papers which investigate the detection of malicious JavaScript include [26], [32], [35], [38], [39].…”

Section: Related Workmentioning

confidence: 99%

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Stokes

Agrawal

McDonald

et al. 2019

Malicious scripts are an important computer infection threat vector in the wild. For web-scale processing, static analysis offers substantial computing efficiencies. We propose the ScriptNet system for neural malicious JavaScript detection which is based on static analysis. We use the Convoluted Partitioning of Long Sequences (CPoLS) model, which processes Javascript files as byte sequences. Lower layers capture the sequential nature of these byte sequences while higher layers classify the resulting embedding as malicious or benign. Unlike previously proposed solutions, our model variants are trained in an end-to-end fashion allowing discriminative training even for the sequential processing layers. Evaluating this model on a large corpus of 212,408 JavaScript files indicates that the best performing CPoLS model offers a 97.20% true positive rate (TPR) for the first 60K byte subsequence at a false positive rate (FPR) of 0.50%. The best performing CPoLS model significantly outperform several baseline models.

Proceedings of the 34th Annual Computer Security Applications Conference

“…Luckily, Rieck et al already introduced notation to describe q-grams in Cujo [38]. The same q-gram representation and set of features were later used by Early-Bird by Schutt et al [40]. Thus, we will use the same notation used by EarlyBird and Cujo to show the bag of words and q-grams approach.…”

Section: Feature Selectionmentioning

confidence: 99%

“…We must clarify that even though Cujo [38] and EarlyBird [40] use the same q-gram representation, our approach uses a dierent set of features oriented to resource-related APIs. More details on similarities and dierences are discussed in Section 5.…”

Section: Feature Selectionmentioning

confidence: 99%

“…To relate the static and dynamic analysis with one another, Rieck et al create q-grams from the reports generated by the static analysis and ADSandbox. EarlyBird [40] is an optimization of Cujo. EarlyBird is a modied linear SVM with the same features as Cujo, yet giving higher weights to malicious events occurring in the early stages of an attack.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Rapid

Rodriguez

Posegga

2018

Direct access to the system's resources such as the GPU, persistent storage and networking has enabled in-browser crypto-mining. Thus, there has been a massive response by rogue actors who abuse browsers for mining without the user's consent. This trend has grown steadily for the last months until this practice, i.e., Crypto-Jacking, has been acknowledged as the number one security threat by several antivirus companies. Considering this, and the fact that these attacks do not behave as JavaScript malware or other Web attacks, we propose and evaluate several approaches to detect in-browser mining. To this end, we collect information from the top 330.500 Alexa sites. Mainly, we used real-life browsers to visit sites while monitoring resourcerelated API calls and the browser's resource consumption, e.g., CPU. Our detection mechanisms are based on dynamic monitoring, so they are resistant to JavaScript obfuscation. Furthermore, our detection techniques can generalize well and classify previously unseen samples with up to 99.99% precision and recall for the benign class and up to 96% precision and recall for the mining class. These results demonstrate the applicability of detection mechanisms as a server-side approach, e.g., to support the enhancement of existing blacklists. Last but not least, we evaluated the feasibility of deploying prototypical implementations of some detection mechanisms directly on the browser. Specically, we measured the impact of in-browser API monitoring on page-loading time and performed micro-benchmarks for the execution of some classiers directly within the browser. In this regard, we ascertain that, even though there are engineering challenges to overcome, it is feasible and benecial for users to bring the mining detection to the browser.