JaSt: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript
Uloženo v:
| Název: | JaSt: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript |
|---|---|
| Autoři: | Fass, Aurore, Krawczyk, Robert, Backes, Michael, Stock, Ben |
| Rok vydání: | 2018 |
| Sbírka: | CISPA – Helmholtz-Zentrum für Informationssicherheit |
| Popis: | JavaScript is a browser scripting language initially created to enhance the interactivity of web sites and to improve their user-friendliness. However, as it offloads the work to the user's browser, it can be used to engage in malicious activities such as Crypto-Mining, Drive-by-Download attacks, or redirections to web sites hosting malicious software. Given the prevalence of such nefarious scripts, the anti-virus industry has increased the focus on their detection. The attackers, in turn, make increasing use of obfuscation techniques, so as to hinder analysis and the creation of corresponding signatures. Yet these malicious samples share syntactic similarities at an abstract level, which enables to bypass obfuscation and detect even unknown malware variants. In this paper, we present JaSt, a low-overhead solution that combines the extraction of features from the abstract syntax tree with a random forest classifier to detect malicious JavaScript instances. It is based on a frequency analysis of specific patterns, which are either predictive of benign or of malicious samples. Even though the analysis is entirely static, it yields a high detection accuracy of almost 99.5% and has a low false-negative rate of 0.54%. |
| Druh dokumentu: | conference object |
| Popis souboru: | text |
| Jazyk: | English |
| Relation: | https://publications.cispa.saarland/2594/1/fass2018jast.pdf; Fass, Aurore and Krawczyk, Robert and Backes, Michael and Stock, Ben (2018) JaSt: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript. In: Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '18). Conference: DIMVA GI International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment |
| Dostupnost: | https://publications.cispa.saarland/2594/ https://publications.cispa.saarland/2594/1/fass2018jast.pdf |
| Přístupové číslo: | edsbas.F714558C |
| Databáze: | BASE |
Nájsť tento článok vo Web of Science Buďte první, kdo okomentuje tento záznam!