Search

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi-layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD-preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD-preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes.

Obfuscation is rampant in both benign and malicious JavaScript (JS) codes. It generates an obscure and undetectable code that hinders comprehension and analysis. Therefore, accurate detection of JS codes that masquerade as innocuous scripts is vital. The existing deobfuscation methods assume that a specific tool can recover an original JS code entirely. For a multi‐layer obfuscation, general tools realize a formatted JS code, but some sections remain encoded. For the detection of such codes, this study performs Deobfuscation, Unpacking, and Decoding (DUD‐preprocessing) by function redefinition using a Virtual Machine (VM), a JS code editor, and a python int_to_str() function to facilitate feature learning by the FastText model. The learned feature vectors are passed to a classifier model that judges the maliciousness of a JS code. In performance evaluation, the authors use the Hynek Petrak's dataset for obfuscated malicious JS codes and the SRILAB dataset and the Majestic Million service top 10,000 websites for obfuscated benign JS codes. They then compare the performance to other models on the detection of DUD‐preprocessed obfuscated malicious JS codes. Their experimental results show that the proposed approach enhances feature learning and provides improved accuracy in the detection of obfuscated malicious JS codes. [ABSTRACT FROM AUTHOR]

As we all known that it is difficult to retrieve the ciphertext on cloud environment, that the existing searchable encryption schemes have low efficiency in time, and that the file retrieval index does not support updating and the retrieval results cannot be sorted by accuracy. In view of these problems, in this paper, we firstly construct the index of document retrieval based on counting bloom filter, and map the keyword hash in the file set to the counting bloom filter index vector so that the retrieval of ciphertext by keyword is achieved. And, at the same time, it supports the dynamic update on retrieval index of the file. Secondly, the sorting of the retrieval results according to the relevancy degree cannot be achieved owing to the counting bloom filter itself does not have the semantic function. We introduce the key words frequency matrix and TF-IDF model to calculate the relevancy scores of key words in order to sort the search results according to the relevance scores. Finally, we prove the security, updatability, sorting capability and time efficiency of the method mentioned in this paper from the aspects of theoretical and experimental performance analysis. [ABSTRACT FROM AUTHOR]