Research on Malicious JavaScript Detection Technology Based on LSTM

Yong Fang

doi:10.1109/ACCESS.2018.2874098

2018-01-01

DOI：10.1109/ACCESS.2018.2874098

原文链接

摘要

En 中文

The attacker injects malicious JavaScript into web pages to achieve the purpose of implanting Trojan horses, spreading viruses, phishing, and obtaining secret information. By analyzing the existing researches on malicious JavaScript detection, a malicious JavaScript detection model based on LSTM (Long Short-Term Memory) is proposed. Features are extracted from the semantic level of bytecode, and the method of word vector is optimized. It can distinguish malicious JavaScript code and combat obfuscated code effectively. Experiments showed that the accuracy of detection model based on LSTM is 99.51%, and the F1-score is 98.37%, which is better than the existing model based on Random Forest and SVM algorithm.

Keyword:

JavaScript

malicious code detection

bytecode

word vector

LSTM