e-Informatica Software Engineering Journal Malicious JavaScript Detection by Features Extraction

Malicious JavaScript Detection by Features Extraction

Gerardo Canfora, Francesco Mercaldo and Corrado Aaron Visaggio
In recent years, JavaScript-based attacks have become one of the most common and successful types of attack. Existing techniques for detecting malicious JavaScripts could fail for different reasons. Some techniques are tailored on specific kinds of attacks, and are ineffective for others. Some other techniques require costly computational resources to be implemented. Other techniques could be circumvented with evasion methods. This paper proposes a method for detecting malicious JavaScript code based on five features that capture different characteristics of a script: execution time, external referenced domains and calls to JavaScript functions. Mixing different types of features could result in a more effective detection technique, and overcome the limitations of existing tools created for identifying malicious JavaScript. The experimentation carried out suggests that a combination of these features is able to successfully detect malicious JavaScript code (in the best cases we obtained a precision of 0.979 and a recall of 0.978).
[1]Gerardo Canfora, Francesco Mercaldo and Corrado Aaron Visaggio, "Malicious JavaScript Detection by Features Extraction", In e-Informatica Software Engineering Journal, vol. 8, pp. 65–78, 2014. DOI: 10.5277/e-Inf140105.

Download article (PDF)Get article BibTeX file

©2015 e-Informatyka.pl, All rights reserved.

Built on WordPress Theme: Mediaphase Lite by ThemeFurnace.