Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly
Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly
复制标题
DOI：
10.1109/sp46214.2022.9833626
复制
发表时间：
2022-05
期刊：
影响因子：
--
通讯作者：
Alan Romano;Daniel Lehmann;Michael Pradel;Weihang Wang
中科院分区：
文献类型：
--
作者：
Alan Romano;Daniel Lehmann;Michael Pradel;Weihang Wang
为了保护Web用户免受恶意JavaScript代码的侵害，已经提出了各种恶意软件探测器，该探测器将代码分析并将代码分类为恶意或良性。最先进的检测器将重点放在JavaScript作为唯一的目标语言上。但是，WebAssembly为攻击者提供了迄今为止逃避恶意软件探测器的新机会。本文介绍了WobFuscator，这是通过将计算的部分移动到WebAssembly中来避免静态JavaScript恶意软件检测的第一条技术。该技术的核心是一组代码转换，将JavaScript中实现的行为的精心选择的部分转换为WebAssembly。这种方法是机会主义的，从某种意义上说，它使用WebAssembly在不影响代码的正确性的情况下有助于逃避恶意软件检测。使用43,499个恶意和149,677个良性JavaScript文件以及六个流行的JavaScript库来评估我们的方法，这表明我们的方法有效地逃避了基于学习的，基于学习的静态恶意软件探测器；混淆是语义上的。而且我们的方法具有小的开销，使其可用于现实世界中的计划。通过查明当前恶意软件探测器的局限性，我们的工作激发了未来在网络中检测多语言恶意软件的努力。
To protect web users from malicious JavaScript code, various malware detectors have been proposed, which analyze and classify code as malicious or benign. State-of-the-art detectors focus on JavaScript as the only target language. However, WebAssembly provides attackers a new and so far unexplored opportunity for evading malware detectors. This paper presents Wobfuscator, the first technique for evading static JavaScript malware detection by moving parts of the computation into WebAssembly. The core of the technique is a set of code transformations that translate carefully selected parts of behavior implemented in JavaScript into WebAssembly. The approach is opportunistic in the sense that it uses WebAssembly where it helps to evade malware detection without compromising the correctness of the code. Evaluating our approach with a dataset of 43,499 malicious and 149,677 benign JavaScript files, as well as six popular JavaScript libraries reveals that our approach is effective at evading state-of-the-art, learning-based static malware detectors; the obfuscation is semantic-preserving; and our approach has small overhead, making it practical for use in real-world programs. By pinpointing limitations of current malware detectors, our work motivates future efforts on detecting multi-language malware in the web.