Evaluation and Comparison of Dynamic Call Graph Generators for JavaScript
Evaluation and Comparison of Dynamic Call Graph Generators for JavaScript
复制标题
JavaScript 动态调用图生成器的评估和比较
DOI：
10.5220/0007752904720479
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Gábor Lóki
中科院分区：
文献类型：
--
作者：
Zoltán Herczeg;Gábor Lóki
JavaScript 是当今最流行的编程语言，也是 Node.js 环境的核心语言。在此环境中共享代码是一项简单的任务，并且可以轻松地将共享代码重用作构建块来创建新应用程序。然而，这个充满活力且不断发展的环境并不完美。由于大量重用代码，即使是简单的应用程序也会有很多间接依赖关系。开发人员甚至可能没有意识到其中一些依赖项可能包含恶意软件，因为由于 JavaScript 的动态特性，有害代码可以相对容易地隐藏起来。动态软件分析是检测可疑活动的一种方法。调用图可以揭示应用程序的内部工作原理，并且它们已成功用于恶意软件检测。在node.js中，之前还没有可以直接生成JavaScript调用图的工具。在本文中，我们将介绍三种可用于生成调用图以进行进一步分析的工具。我们表明，调用图包含大量特定于引擎的信息，但可以使用过滤器来减少此类差异。
JavaScript is the most popular programming language these days and it is also the core language of the node.js environment. Sharing code is a simple task in this environment and the shared code can be easily reused as building blocks to create new applications. This vibrant and ever growing environment is not perfect though. Due to the large amount of reused code, even simple applications can have a lot of indirect dependencies. Developers may not even be aware of the fact that some of these dependencies could contain malware, since harmful code can be hidden relatively easily due to the dynamic nature of JavaScript. Dynamic software analysis is one way of detecting suspicious activities. Call graphs can reveal the internal workings of an application and they have been used successfully for malware detection. In node.js, no tool has been available for directly generating JavaScript call graphs before. In this paper, we are going to introduce three tools that can be used to generate call graphs for further analysis. We show that call graphs contain a significant amount of engine-specific information but filters can be used to reduce such differences.