Method for de-obfuscating JavaScript code in web page

Abstract

The invention relates to a method for de-obfuscating a JavaScript code in a web page, which improves a feature-based static detection method by de-obfuscating processing of script codes. The method comprises the step of formatting and semantically restoring the script code in the web page; determining a de-obfuscated code corresponding to each obfuscated code from the script code; and restoring the original code hidden in the obfuscated code through the de-obfuscated code. The invention can effectively restore the original code hidden in the obfuscated code in the web page, so as to re-exposethe obfuscated characteristics, thereby remarkably improving the detection rate of the malicious web page detection engine to the obfuscated malicious web page. In addition, the code structure, semantics and format after deobfuscated processing are improved to facilitate the data flow and control flow analysis for the method which can be combined with other tools to assist code analysis, improve efficiency, or as a browser plug-in, to quickly evaluate the browsed web pages, and give a security analysis report.

Description

technical field [0001] The invention relates to a JavaScript code deobfuscation method in a webpage. Background technique [0002] At present, many security vendors have released feature-based malicious webpage detection engines, which can effectively detect malicious webpages that do not contain obfuscated codes, and protect the information security of Internet users to a large extent. However, malicious webpages often use obfuscation techniques to confuse malicious codes and deobfuscate codes, so as to hide the characteristics of malicious codes and avoid detection by malicious webpage detection engines. Therefore, effective detection of malicious web pages containing obfuscated codes has important practical significance for protecting the information and system security of Internet users. [0003] In recent years, domestic and foreign research on malicious webpage detection mainly adopts machine learning methods, and the learning algorithms used cover commonly used machi...

AI Technical Summary

Problems solved by technology

This feature enables both obfuscated codes and deobfuscated codes to be distributed in the webpage in the form of data. These data have no obvious characteristics and poor readability, which increases the difficulty of defining obfuscated codes and deobfuscated codes; secondly, the weak type of the JavaScript language makes The variable type in the code is variable during the code running process

This feature makes the data containing the obfuscated code and the relevant data used to generate the deobfuscated code possibly heterogeneous, which leads to weakened or even unclear association between the obfuscated code and the deobfuscated code

In addition, benign webpages often use obfuscation methods to protect data and intellectual property rights, so whether obfuscated codes are included cannot be used as a feature for judging malicious webpages

Images