Webpage malicious JavaScript code recognition and anti-obfuscation method based on hybrid analysis

Abstract

The invention relates to a webpage malicious JavaScript code recognition and anti-obfuscation method based on hybrid analysis. The webpage malicious JavaScript code recognition and anti-obfuscation method comprises the following steps: firstly, collecting related webpage source codes, and extracting malicious JS files in the source codes and malicious JS codes embedded in HTML documents; then, constructing an abstract syntax tree in the syntax analysis stage, and expressing nodes as conventional JS objects for program analysis and feature extraction; then, carrying out instrumentation on the JS code, carrying out overwriting on basic operation, needing to be monitored, during running, of the JS code, dynamically monitoring the state and information during JS execution, and extracting an execution track and dynamic characteristic information during running; then, rewriting the dynamic and static features into feature vectors, and training a malicious JS code recognition model based on arandom forest algorithm model; and then, based on a dynamic instrumentation method, monitoring and recording memory overwriting related operations, and carrying out effective anti-obfuscation on obfuscated malicious JS codes.

Description

technical field [0001] The invention belongs to the field of computer technology, especially the field of software technology. The present invention proposes a method and an anti-obfuscation method for detecting malicious JavaScript (JS) codes in webpages based on hybrid analysis (combination of dynamic and static analysis), which can effectively identify and intercept malicious JS codes in current webpages, and at the same time, confuse malicious JS codes. Do effective deobfuscation. Background technique [0002] As one of the most popular scripting languages ​​in the world, JS plays an important role in web-based applications and services, and is used by millions of web pages to optimize interface design, verify form data, check browser information, and respond to browsing server events, control cookies, and more. [0003] Many features of JS bring great convenience to the development of browser client and server. First of all, as a typical dynamic programming language,...

AI Technical Summary

Problems solved by technology

[0004] At present, many detection methods have been proposed to detect malicious JS codes in web pages. However, with the wide application of obfuscation technology in JS codes, many traditional detection methods are no longer suitable for detecting malicious JS codes.

For example, most Internet users choose to use anti-virus software to detect malicious JS code, but it has been found that since most popular anti-virus software uses signature-based detection schemes, some of them even use exact matching to detect malicious JS Code, for the obfuscated malicious JS code, the average accuracy of anti-virus software detection is less than 50%

In addition, because the malicious JS code is poorly readable after being obfuscated, even if it is detected correctly, people do not know what method the code uses to attack

Images