.png){kind=icon}
.png){kind=icon}
Return
Toward Reliable Malicious JavaScript Detection in Obfuscated Code
.png){kind=icon}
PRE
AI
X
X
C
S
S
C
DOI：10.1109/tifs.2026.3714264.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
JavaScript is the primary programming language for web applications. With the increasing security requirements for web applications, more and more applications are using code obfuscation methods to protect code security. In recent years, many static analysis-based malicious JavaScript detection methods have been proposed, achieving quite high accuracy on target datasets. However, their performance on obfuscated code remains questionable. Unfortunately, existing malicious JavaScript detection methods mainly discuss the effectiveness of methods under the condition of obfuscated malicious code, without considering other situations such as obfuscated benign code and the choice of code obfuscation methods. In this paper, we first conduct a systematic discussion on the impact of code obfuscation on malicious code detection methods and find that existing methods cannot resist medium strength obfuscation. At the same time, we propose a malicious JavaScript code detection method, SeGra, based on data flow features, which combines random walk methods to address the issues of large obfuscated code size and semantic fragmentation. SeGra converts graph structure information, which has a high representation overhead, into sequence information while retaining topological relationships. We evaluate the performance of the method under different levels of obfuscation strength and known conditions. Experimental results show that in medium/low obfuscation strength code, SeGra significantly outperforms mainstream methods, achieving an accuracy of 99.5% and 70.4%, respectively, with average improvements of 12.4% and 16.2% over mainstream methods. Furthermore, it can further improve method performance by learning features from low strength obfuscated code, achieving an accuracy of 67.1% in high obfuscation strength code, which is an average improvement of 13.2% over mainstream methods under the same conditions.
Keywords:
Malicious code detection
deep learning
static analysis
code obfuscation
Journal
IF:
8
Papers:
5.2K
Citations:
2.3W
Organization
Cited Papers