Filtering Malicious JavaScript Code with Doc2Vec on an Imbalanced Dataset
Filtering Malicious JavaScript Code with Doc2Vec on an Imbalanced Dataset
复制标题
DOI：
10.1109/asiajcis.2019.000-9
复制
发表时间：
2019-08
期刊：
影响因子：
--
通讯作者：
M. Mimura;Yuya Suga
中科院分区：
文献类型：
--
作者：
M. Mimura;Yuya Suga
飞车下载攻击是互联网上的主要威胁之一。有几种检测方法用于构建允许JavaScript代码运行的运行时环境，并在运行时跟踪其行为。动态分析需要太多的时间来检查客户端访问的所有网页。因此，需要轻量级的过滤方法来检测不可见的恶意JavaScript片段。静态分析通常从每个网页的相关JavaScript代码中提取统计和词法特征，以便构建检测模型。通常，静态分析不会带来运行时开销。然而，这些方法容易受到代码混淆技术的攻击。一些研究人员试图用自然语言处理（NLP）技术来检测混淆的VBA宏。在这些方法中，与传统方法相比，神经网络可以自动提取特征。此外，由于几种方法是使用平衡数据集进行评估的，因此实际性能仍有待讨论。为了评估实际性能，这些方法必须在不平衡数据集上进行评估。在本文中，我们尝试使用Doc2Vec检测看不见的恶意JavaScript片段，Doc2Vec是一种无监督算法，用于使用神经网络为文档生成向量。为了缓解类不平衡问题，我们的方法使用了基于聚类的欠采样技术。此外，我们构建了一个网络爬虫，并生成了一个超过20,000个样本的不平衡数据集。评价结果表明，该方法的f值为0.71。
Drive-by download attacks are one of main threats on the Internet. Several detection methods are to build run-time environments that allow JavaScript code to run and track its behavior while it runs. Dynamic analysis requires too much time to examine all the web pages a client accesses. Hence, lightweight filtering methods to detect unseen malicious JavaScript snippets are required. Static analysis often extracts statistical and lexical features from the associated JavaScript code of each web page in order to build detection models. In general, static analysis imposes no runtime overhead. These methods are, however, vulnerable to code obfuscation techniques. Some researchers attempt to detect obfuscated VBA macros with Natural Language Processing (NLP) techniques. In these methods, neural networks extract the features automatically in contrast with traditional approaches. In addition, since several methods are evaluated with a balanced dataset, the practical performance is still open to discussion. To evaluate the practical performance, these methods have to be evaluated with imbalanced datasets. In this paper, we attempt to detect unseen malicious JavaScript snippets with Doc2Vec, an unsupervised algorithm to generate vectors for documents with neural networks. To mitigate the class imbalance problem, our method uses a clustering-based undersampling technique. Furthermore, we build a web crawler and generate an imbalanced dataset with over 20,000 samples. The evaluation result shows that our method achieves a F-measure of 0.71.