J-Force: Forced Execution on JavaScript
J-Force: Forced Execution on JavaScript
复制标题
J-Force：强制执行 JavaScript
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Dongyan Xu
中科院分区：
文献类型：
--
作者：
Kyungtae Kim;I. L. Kim;C. Kim;Yonghwi Kwon;Yunhui Zheng;X. Zhang;Dongyan Xu
如今，基于Web的恶意软件配备了隐形伪装和混淆技术，变得越来越复杂。在本文中，我们提出了J-FORCE，一个无崩溃的强制JavaScript执行引擎，系统地探索可能的执行路径，并揭示此类恶意软件中的恶意行为。特别是，J-FORCE记录分支结果并使其变异以供进一步探索。J-FORCE检查可能揭示恶意意图和暴露可疑DOM注入的函数参数值。我们解决了遇到的一些技术挑战。例如，我们跟踪丢失的对象和DOM元素，并根据需要创建它们。为了验证我们的技术的有效性，我们应用J-FORCE来检测漏洞利用工具包（EK）攻击和恶意Chrome扩展。我们观察到，与现有工具相比，J-FORCE更有效。
Web-based malware equipped with stealthy cloaking and obfuscation techniques is becoming more sophisticated nowadays. In this paper, we propose J-FORCE, a crash-free forced JavaScript execution engine to systematically explore possible execution paths and reveal malicious behaviors in such malware. In particular, J-FORCE records branch outcomes and mutates them for further explorations. J-FORCE inspects function parameter values that may reveal malicious intentions and expose suspicious DOM injections. We addressed a number of technical challenges encountered. For instance, we keep track of missing objects and DOM elements, and create them on demand. To verify the efficacy of our techniques, we apply J-FORCE to detect Exploit Kit (EK) attacks and malicious Chrome extensions. We observe that J-FORCE is more effective compared to the existing tools.