Abstract:The paper deals with a problem of the obfuscated JavaScript code detection and classification based on Abstract Syntax Trees (AST) coloring. Colors of the AST vertexes and edges are assigned with regard to the types of the AST vertexes specified by the program lexical and syntax structure and the programming language standard. Research involved a few stages. First of the all, a non-obfuscated JavaScript programs dataset was collected by the public repositories evaluation. Secondly, obfuscated samples were created using eight open-source obfuscators. Classifier models were built using an algorithm of gradient boosting on the decision trees (GBDT). We built two types of the classifiers. The first one is the model that classifies the program according to the type of the obfuscator used, i.e. based on what obfuscator created the sample. The second one tries to detect samples obfuscated by the obfuscator whose samples are not observed during training. The quality of the obtained models is on par with the known published results. The feature engineering method proposed in the paper does not require a preliminary analysis of the obfuscators and obfuscating transformations. In the final part of the paper we analyze a quality of models estimated, discussing the certain statistical properties of the obfuscated and non-obfuscated samples obtained and corresponding colored ASTs. Analysis of generated samples of obfuscated programs has shown that the method proposed in the paper has some limitations. In particular, it is difficult to recognize minifiers or other obfuscating programs, which change the lexical structure to a greater extent and the syntax to a lesser extent. To improve the quality of detection of this kind of obscuring transformations, one can built combined classifiers using both the method based on the AST coloring and the additional information about lexemes and punctuation, for example, entropy of identifiers and strings, proportion of characters in upper and lower case, usage frequency of certain characters etc.

Statically Detecting JavaScript Obfuscation and Minification Techniques in the Wild

Optimizing Away JavaScript Obfuscation

Malicious JavaScript Code Detection Based on Hybrid Analysis

Looking for Criminal Intents in JavaScript Obfuscated Code

Obfuscated Malicious Javascript Detection by Machine Learning

JStill: mostly static detection of obfuscated malicious JavaScript code

Detection of Obfuscated Malicious JavaScript Code

TransAST: A Machine Translation-Based Approach for Obfuscated Malicious JavaScript Detection.

JSRevealer: A Robust Malicious JavaScript Detector Against Obfuscation.

Detecting Malicious JavaScript Code Based on Semantic Analysis.

Detecting Malicious Behaviors in JavaScript Applications.

A deep learning approach for detecting malicious JavaScript code

Research on Obfuscating Transformation Technology for Malicious Code

Detection and analysis of malicious JavaScript code based on pre-filter

An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors

ScriptNet: Neural Static Analysis for Malicious JavaScript Detection

Fakeium: A Dynamic Execution Environment for JavaScript Program Analysis

Detection of Obfuscated Javascript Code Based on Abstract Syntax Trees Coloring

Cryptic Bytes: WebAssembly Obfuscation for Evading Cryptojacking Detection

Static detection of malicious JavaScript-bearing PDF documents

Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis