Abstract:JavaScript plays an important role in web applications and services, which is used by millions of web pages in optimizing interface design, embedding dynamic texts, reading and writing HTML elements, validating form data, responding to browser events, controlling cookies and much more. However, since JavaScript is cross-platform and can be executed dynamically, it has been a major vehicle for web-based attacks. Existing solutions work by performing static analysis or monitoring program execution dynamically. However, since the heavy use of obfuscation techniques, many methods no longer apply to malicious JavaScript code detection, and it has been a huge challenge to de-obfuscate obfuscated malicious JavaScript code accurately. In this paper, we propose a hybrid analysis method combining static and dynamic analysis for detecting malicious JavaScript code that works by first conducting syntax analysis and dynamic instrumentation to extract internal features that are related to malicious code and then performing classificationbased detection to distinguish attacks. In addition, based on code instrumentation, we propose a new method which can deobfuscate part of obfuscated malicious JavaScript code accurately. Ultimately, we implement a browser plug-in called MJDetector and perform evaluation on 450 real web pages. Evaluation results show that our method can detect malicious JavaScript code and de-obfuscate obfucation effectively and efficiently. Specifically, MJDetector can detect JavaScipt attacks in current web pages with high accuracy 94.76% and de-obfuscate obfuscate code of specific types with accuracy 100% whereas the base line method can only detect with accuracy 81.16% and has no capacity of de-obfuscation.

An efficient malicious webpage static detection framework based on optimized Bayesian and hybrid machine learning

Real-time Detection of Malicious Web Pages Based on Statistical Learning

A Novel Framework for Learning to Detect Malicious Web Pages

MMWD: An efficient mobile malicious webpage detection framework based on deep learning and edge cloud

A Deep Learning Approach to Fast, Format-Agnostic Detection of Malicious Web Content

A deep learning approach for detecting malicious JavaScript code

Malicious URL Detection with Feature Extraction Based on Machine Learning

A Markov Detection Tree-Based Centralized Scheme to Automatically Identify Malicious Webpages on Cloud Platforms.

TSMWD: A High-Speed Malicious Web Page Detection System Based on Two-Step Classifiers

Malicious Web Page Detection Based on On-Line Learning Algorithm

Lightweight method for detecting JavaScript-based malicious Web pages

Malicious JavaScript Code Detection Based on Hybrid Analysis

A Combined Static and Dynamic Analysis Approach to Detect Malicious Browser Extensions

Detecting Malicious JavaScript Code Based on Semantic Analysis.

Malicious Web Pages Detection Based On Abnormal Visibility Recognition

Fine-Grained Mining and Classification of Malicious Web Pages

Textual and visual content-based anti-phishing: a Bayesian approach

A Malicious Web Page Detection Model Based on SVM Algorithm

A Static Detection Model of Malicious PDF Documents Based on Naive Bayesian Classifier Technology

A Malicious Webpage Detection Algorithm Based on Image Semantics

An Evasion and Counter-Evasion Study in Malicious Websites Detection