Abstract:JavaScript plays an important role in web applications and services, which is used by millions of web pages in optimizing interface design, embedding dynamic texts, reading and writing HTML elements, validating form data, responding to browser events, controlling cookies and much more. However, since JavaScript is cross-platform and can be executed dynamically, it has been a major vehicle for web-based attacks. Existing solutions work by performing static analysis or monitoring program execution dynamically. However, since the heavy use of obfuscation techniques, many methods no longer apply to malicious JavaScript code detection, and it has been a huge challenge to de-obfuscate obfuscated malicious JavaScript code accurately. In this paper, we propose a hybrid analysis method combining static and dynamic analysis for detecting malicious JavaScript code that works by first conducting syntax analysis and dynamic instrumentation to extract internal features that are related to malicious code and then performing classificationbased detection to distinguish attacks. In addition, based on code instrumentation, we propose a new method which can deobfuscate part of obfuscated malicious JavaScript code accurately. Ultimately, we implement a browser plug-in called MJDetector and perform evaluation on 450 real web pages. Evaluation results show that our method can detect malicious JavaScript code and de-obfuscate obfucation effectively and efficiently. Specifically, MJDetector can detect JavaScipt attacks in current web pages with high accuracy 94.76% and de-obfuscate obfuscate code of specific types with accuracy 100% whereas the base line method can only detect with accuracy 81.16% and has no capacity of de-obfuscation.

Static detection of malicious JavaScript-bearing PDF documents

De-obfuscation and Detection of Malicious PDF Files with High Accuracy

A Static Detection Model of Malicious PDF Documents Based on Naive Bayesian Classifier Technology

A Universal Malicious Documents Static Detection Framework Based on Feature Generalization

WattsUpDoc: Power Side Channels to Nonintrusively Discover Untargeted Malware on Embedded Medical Devices

Malicious JavaScript Code Detection Based on Hybrid Analysis

AN IMPROVED STATIC DETECTION SCHEME FOR MALICIOUS PDF DOCUMENTS

PDF-Malware: An Overview on Threats, Detection and Evasion Attacks

JStill: mostly static detection of obfuscated malicious JavaScript code

HAPSSA: Holistic Approach to PDF Malware Detection Using Signal and Statistical Analysis

Detection of Obfuscated Malicious JavaScript Code

Detection and analysis of malicious JavaScript code based on pre-filter

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Static Semantics Reconstruction for Enhancing JavaScript-WebAssembly Multilingual Malware Detection

Digital Investigation of PDF Files: Unveiling Traces of Embedded Malware

A deep learning approach for detecting malicious JavaScript code

Obfuscated Malicious Javascript Detection by Machine Learning

PDF Malware Detection Based on Optimizable Decision Trees

Statically Detecting JavaScript Obfuscation and Minification Techniques in the Wild

A Static Method for Detection of Information Theft Malware

JSRevealer: A Robust Malicious JavaScript Detector Against Obfuscation.