Malicious JavaScript Detection via AST and Graph Convolutional Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting malicious interpreted language scripts, such as JavaScript, are error-prone and resource-intensive, relying on traditional supervised machine learning and struggling to classify sparse and obfuscated scripts effectively.
Innovation Solution
The use of a graph convolutional neural network (gCNN) in conjunction with abstract syntax trees (ASTs) to classify software objects as malicious, suspicious, or benign, leveraging deep machine learning to generate features and determine the probability of maliciousness without the need for feature engineering or parsing the object.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional supervised machine learning methods are used to detect malicious scripts, then the system can classify scripts, but the detection becomes error-prone and resource-intensive
Solution Approach 1:
The patent replaces traditional supervised machine learning mechanisms with deep machine learning models (specifically graph convolutional neural networks) that automatically learn representations from AST structures. This substitution eliminates the need for manual feature engineering and traditional ML pipelines, resulting in more accurate detection with reduced computational overhead through optimized deep learning inference.
Solution Approach 2:
The patent changes the fundamental parameters of the detection system by transitioning from traditional ML algorithms to deep learning models that operate on transformed AST representations. This parameter change enables the system to handle sparse and obfuscated scripts more effectively while reducing the resource intensity associated with traditional supervised learning approaches.
2Ease of manufacture
If traditional machine learning models are used, then script classification is possible, but the models require extensive feature engineering and parsing resources
Solution Approach 1:
The deep learning model performs self-service by automatically learning optimal feature representations from the AST structures during training. This eliminates the need for external feature engineering efforts, as the model autonomously identifies and extracts relevant patterns from the input data, significantly reducing development time and complexity.
Solution Approach 2:
The system performs preliminary action by pre-processing scripts into standardized AST representations before feeding them to the deep learning model. This preliminary transformation simplifies the subsequent classification task and eliminates the need for complex feature engineering, as the AST structure provides a normalized representation that the model can process directly.
3Productivity
If deep machine learning with gCNN is applied to ASTs, then detection accuracy improves and scalability increases, but the system complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the detection system into distinct modular components: AST generation module, graph construction module, gCNN classification module, and alert generation module. This segmentation allows each component to be optimized independently and simplifies the overall system architecture despite using deep learning techniques, improving both productivity and maintainability.
Data Source
AI summary
A method for assessing a cybersecurity risk of a software object includes generating an abstract syntax tree (AST) for a software object, and determining that the AST is insufficient to identify, to a specified confidence level, a cybersecurity risk of the software object. In response to determining that the AST is insufficient to identify the cybersecurity risk of the software object, a graph convolutional neural network (gCNN) is executed, based on the AST, to produce a set of features for the AST and to produce a probability of maliciousness of the software object based on the set of features. A signal representing an alert is sent, based on the probability of maliciousness, if the probability of maliciousness exceeds a pre-defined threshold.


