Abstract:Machine learning is increasingly being applied to malicious JavaScript detection in response to the growing number of Web attacks and the attendant costly manual identification. In practice, to hide their malicious behaviors or protect intellectual copyrights, both malicious and benign scripts tend to obfuscate their own code before uploading. While obfuscation is beneficial, it also introduces some additional code features (e.g., dead code) into the code. When machine learning is employed to learn a malicious JavaScript detector, these additional features can affect the model to make it less effective. However, there is still a lack of clear understanding of how robust existing machine learning-based detectors are on different obfuscators. In this paper, we conduct the first empirical study to figure out how obfuscation affects machine learning detectors based on static features. Through the results, we observe several findings: 1) Obfuscation has a significant impact on the effectiveness of detectors, causing an increase both in false negative rate (FNR) and false positive rate (FPR), and the bias of obfuscation in the training set induces detectors to detect obfuscation rather than malicious behaviors. 2) The common measures such as improving the quality of the training set by adding relevant obfuscated samples and leveraging state-of-the-art deep learning models can not work well.3) The root cause of obfuscation effects on these detectors is that feature spaces they use can only reflect shallow differences in code, not about the nature of benign and malicious, which can be easily affected by the differences brought by obfuscation. 4) Obfuscation has a similar effect on realistic detectors in VirusTotal, indicating that this is a common real-world problem.

Malicious JavaScript Code Detection Based on Hybrid Analysis

Detecting and De-Obfuscating Obfuscated Malicious JavaScript Code

Obfuscated Malicious Javascript Detection by Machine Learning

Detection of Obfuscated Malicious JavaScript Code

JSRevealer: A Robust Malicious JavaScript Detector Against Obfuscation.

JStill: mostly static detection of obfuscated malicious JavaScript code

A deep learning approach for detecting malicious JavaScript code

Detecting Malicious JavaScript Code Based on Semantic Analysis.

JSDC: A Hybrid Approach for JavaScript Malware Detection and Classification

Detecting Malicious Behaviors in JavaScript Applications.

Lightweight method for detecting JavaScript-based malicious Web pages

Detection and analysis of malicious JavaScript code based on pre-filter

Statically Detecting JavaScript Obfuscation and Minification Techniques in the Wild

Detection and classification of malicious JavaScript via attack behavior modelling

Looking for Criminal Intents in JavaScript Obfuscated Code

Optimizing Away JavaScript Obfuscation

Malicious JavaScript Detection Based on Bidirectional LSTM Model

An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors

Malicious Web Pages Detection Based On Abnormal Visibility Recognition

Research and detection of high-obfuscated malicious Web pages

JStrong: Malicious JavaScript detection based on code semantic representation and graph neural network