Bitte benutzen Sie diese Kennung, um auf die Ressource zu verweisen:
https://doi.org/10.21256/zhaw-1537| Publikationstyp: | Beitrag in wissenschaftlicher Zeitschrift |
| Art der Begutachtung: | Peer review (Publikation) |
| Titel: | Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning |
| Autor/-in: | Tellenbach, Bernhard Paganoni, Sergio Rennhard, Marc |
| DOI: | 10.21256/zhaw-1537 |
| Erschienen in: | International Journal on Advances in Security |
| Band(Heft): | 9 |
| Heft: | 3/4 |
| Seite(n): | 196 |
| Seiten bis: | 206 |
| Erscheinungsdatum: | 2016 |
| Verlag / Hrsg. Institution: | IARIA |
| ISSN: | 1942-2636 |
| Sprache: | Englisch |
| Schlagwörter: | Machine Learning; JavaScript obfuscation |
| Fachgebiet (DDC): | 006: Spezielle Computerverfahren |
| Zusammenfassung: | JavaScript is a common attack vector to probe for known vulnerabilities to select a fitting exploit or to manipulate the Document Object Model (DOM) of a web page in a harmful way. The JavaScripts used in such attacks are often obfuscated to make them hard to detect using signature-based approaches. On the other hand, since the only legitimate reason to obfuscate a script is to protect intellectual property, there are not many scripts that are both benign and obfuscated. A detector that can reliably detect obfuscated JavaScripts would therefore be a valuable tool in fighting JavaScript based attacks. In this paper, we compare the performance of nine different classifiers with respect to correctly classifying obfuscated and non-obfuscated scripts. For our experiments, we use a data set of regular, minified, and obfuscated samples from jsDeliver and the Alexa top 5000 websites and a set of malicious samples from MELANI. We find that the best of these classifiers, the boosted decision tree classifier, performs very well to correctly classify obfuscated and non-obfuscated scripts with precision and recall rates of around 99 percent. The boosted decision tree classifier is then used to assess how well this approach can cope with scripts obfuscated by an obfuscator not present in our training set. The results show that while it may work for some obfuscators, it is still critical to have as many different obfuscators in the training set as possible. Finally, we describe the results from experiments to classify malicious obfuscated scripts when no such scripts are included in the training set. Depending on the set of features used, it is possible to detect about half of those scripts, even though those samples do not seem to use any of the obfuscators used in our training set. |
| URI: | https://digitalcollection.zhaw.ch/handle/11475/1601 |
| Volltext Version: | Publizierte Version |
| Lizenz (gemäss Verlagsvertrag): | Lizenz gemäss Verlagsvertrag |
| Departement: | School of Engineering |
| Organisationseinheit: | Institut für Informatik (InIT) |
| Enthalten in den Sammlungen: | Publikationen School of Engineering |
Dateien zu dieser Ressource:
| Datei | Beschreibung | Größe | Format | |
|---|---|---|---|---|
| 2017_Tellenbach_Detecting_obfuscated_JavaScripts_Advance_in_Securtiy.pdf | 210.91 kB | Adobe PDF |  Öffnen/Anzeigen |
Zur Langanzeige
Tellenbach, B., Paganoni, S., & Rennhard, M. (2016). Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning. International Journal on Advances in Security, 9(3/4), 196–206. https://doi.org/10.21256/zhaw-1537
Tellenbach, B., Paganoni, S. and Rennhard, M. (2016) ‘Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning’, International Journal on Advances in Security, 9(3/4), pp. 196–206. Available at: https://doi.org/10.21256/zhaw-1537.
B. Tellenbach, S. Paganoni, and M. Rennhard, “Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning,” International Journal on Advances in Security, vol. 9, no. 3/4, pp. 196–206, 2016, doi: 10.21256/zhaw-1537.
TELLENBACH, Bernhard, Sergio PAGANONI und Marc RENNHARD, 2016. Detecting obfuscated JavaScripts from known and unknown obfuscators using machine learning. International Journal on Advances in Security. 2016. Bd. 9, Nr. 3/4, S. 196–206. DOI 10.21256/zhaw-1537
Tellenbach, Bernhard, Sergio Paganoni, and Marc Rennhard. 2016. “Detecting Obfuscated JavaScripts from Known and Unknown Obfuscators Using Machine Learning.” International Journal on Advances in Security 9 (3/4): 196–206. https://doi.org/10.21256/zhaw-1537.
Tellenbach, Bernhard, et al. “Detecting Obfuscated JavaScripts from Known and Unknown Obfuscators Using Machine Learning.” International Journal on Advances in Security, vol. 9, no. 3/4, 2016, pp. 196–206, https://doi.org/10.21256/zhaw-1537.
Alle Ressourcen in diesem Repository sind urheberrechtlich geschützt, soweit nicht anderweitig angezeigt.