JSContana: Malicious JavaScript detection using adaptable context analysis and key feature extraction. Issue 104 (May 2021)

• Record Type: Journal Article
• Authors: Huang, Yunhua; Li, Tao; Zhang, Lijia; Li, Beibei; Liu, Xiaojie
• Is Part Of: Computers & security. Issue 104(2021)
• Publication Date: 2021-05
• Subjects: Malicious JavaScript detection -- Context analysis -- Dynamic word embeddings -- Key feature extraction -- TextCNN; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102218
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: JavaScript has played a crucial role in web development, making it a primary tool for hackers to launch assaults. Although malicious JavaScript detection methods are becoming increasingly effective, the existing methods based on feature matching or static word embeddings are difficult to detect different versions and obfuscation of JavaScript code. To solve this problem, we present JSContana, a novel detection method that consists of adaptable context analysis and efficient key feature extraction. The key to our approach is context analysis based on dynamic word embeddings. We convert JavaScript code to syntax unit sequences with detailed information and get the real contextual representation of code by dynamic word embeddings. Furthermore, as a classification module in the method, TextCNN can effectively extract key features. To demonstrate the performance of the method, we have conducted extensive comparison experiments under five-fold cross-validation. Numerical results show that the method achieves 0.990 in AUC-score, and outperforms the state-of-the-art method by up to 3.5%.