Detection of malicious javascript on an imbalanced dataset
Detection of malicious javascript on an imbalanced dataset
复制标题
DOI：
10.1016/j.iot.2021.100357
复制
发表时间：
2021-01-15
影响因子：
5.9
通讯作者：
Mimura, Mamoru
中科院分区：
文献类型：
--
作者：
Phung, Ngoc Minh;Mimura, Mamoru
为了能够以低成本检测新的恶意JavaScript，人们提出了使用机器学习技术的方法，并取得了积极的成果。这些方法的重点是实现一个轻量级的过滤模型，可以快速准确地过滤出恶意数据进行动态分析。一种使用自然语言处理技术构建语言模型的方法，以向量形式表示机器学习源代码中的数据。该方法在平衡数据集上得分较高，但在不平衡数据集上的实验尚未完成。以往的研究主要集中在平衡数据集上，但数据集不能代表现实世界的数据，这给模型的实际应用带来了问题。一个好的过滤器需要一个好的模型，它可以在不平衡的数据集上有很高的召回分数。为了构建有效的语言模型，并解决数据不平衡问题，我们重点研究了过采样技术。在我们的研究中，我们的方法是第一个使用过采样和机器学习来检测恶意JavaScript。实验结果表明，该方法能够更加准确、高效地检测出新的恶意JavaScript。该模型可以快速过滤出恶意数据进行动态分析。Doc2Vec模型的召回分数达到了0.72。在每个样本的训练时间和测试时间相同的情况下，我们提出的方法在回忆得分方面比基线方法高出210%。(C) 2021 Elsevier B.V.版权所有
In order to be able to detect new malicious JavaScript with low cost, methods with machine learning techniques have been proposed and gave positive results. These methods focus on achieving a light-weight filtering model that can quickly and precisely filter out malicious data for dynamic analysis. A method constructs a language model using Natural Language Processing techniques to represent the data in vector form from the source code for machine learning. This method has high score with the balanced dataset, however the experiment with an imbalanced dataset has not been done. Previous studies mainly focus on a balanced dataset, however the dataset is not representative of real-world data, and it rises questions in practical uses of the model. A good model that can have a high recall score with imbalanced dataset is needed for a good filter. To construct an efficient language model, and to deal with the data imbalance problem, we focus on oversampling techniques. In our research, our method is the first to use oversampling and machine learning to detect malicious JavaScript. The experimental result shows that our method can detect new malicious JavaScript more accurately and efficiently. Our model can quickly filter out malicious data for dynamic analysis. The best recall score achieves 0.72 with the Doc2Vec model. Our proposed method is shown to outperform the baseline method by 210% in terms of recal score with the same training time and test time per sample. (C) 2021 Elsevier B.V. All rights reserved.