Malicious JavaScript Detection via AST and Graph Convolutional Neural Networks

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for detecting malicious interpreted language scripts, such as JavaScript, are error-prone and resource-intensive, relying on traditional supervised machine learning and struggling to classify sparse and obfuscated scripts effectively.

Innovation Solution

The use of a graph convolutional neural network (gCNN) in conjunction with abstract syntax trees (ASTs) to classify software objects as malicious, suspicious, or benign, leveraging deep machine learning to generate features and determine the probability of maliciousness without the need for feature engineering or parsing the object.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional supervised machine learning methods are used to detect malicious scripts, then the system can classify scripts, but the detection becomes error-prone and resource-intensive

Engineering Contradiction:
Improvedetection accuracyVSAvoidcomputational resource consumption
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent replaces traditional supervised machine learning mechanisms with deep machine learning models (specifically graph convolutional neural networks) that automatically learn representations from AST structures. This substitution eliminates the need for manual feature engineering and traditional ML pipelines, resulting in more accurate detection with reduced computational overhead through optimized deep learning inference.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent changes the fundamental parameters of the detection system by transitioning from traditional ML algorithms to deep learning models that operate on transformed AST representations. This parameter change enables the system to handle sparse and obfuscated scripts more effectively while reducing the resource intensity associated with traditional supervised learning approaches.

Inventive Principle:
Principle #35Parameter changes

2Ease of manufacture

If traditional machine learning models are used, then script classification is possible, but the models require extensive feature engineering and parsing resources

Engineering Contradiction:
Improvemodel development complexityVSAvoidfeature engineering time
Core Design Contradiction:
Ease of manufactureVSLoss of time

Solution Approach 1:

The deep learning model performs self-service by automatically learning optimal feature representations from the AST structures during training. This eliminates the need for external feature engineering efforts, as the model autonomously identifies and extracts relevant patterns from the input data, significantly reducing development time and complexity.

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system performs preliminary action by pre-processing scripts into standardized AST representations before feeding them to the deep learning model. This preliminary transformation simplifies the subsequent classification task and eliminates the need for complex feature engineering, as the AST structure provides a normalized representation that the model can process directly.

Inventive Principle:
Principle #10Preliminary action

3Productivity

If deep machine learning with gCNN is applied to ASTs, then detection accuracy improves and scalability increases, but the system complexity increases

Engineering Contradiction:
Improvedetection throughputVSAvoidsystem architecture complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the detection system into distinct modular components: AST generation module, graph construction module, gCNN classification module, and alert generation module. This segmentation allows each component to be optimized independently and simplifies the overall system architecture despite using deep learning techniques, improving both productivity and maintainability.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS11886582B1Malicious javascript detection based on abstract syntax trees (AST) and deep machine learning (DML)
Publication Date: 2024.01.30 GOOGLE LLC
  • US11886582B1 patent drawing
  • US11886582B1 patent drawing
  • US11886582B1 patent drawing

AI summary

A method for assessing a cybersecurity risk of a software object includes generating an abstract syntax tree (AST) for a software object, and determining that the AST is insufficient to identify, to a specified confidence level, a cybersecurity risk of the software object. In response to determining that the AST is insufficient to identify the cybersecurity risk of the software object, a graph convolutional neural network (gCNN) is executed, based on the AST, to produce a set of features for the AST and to produce a probability of maliciousness of the software object based on the set of features. A signal representing an alert is sent, based on the probability of maliciousness, if the probability of maliciousness exceeds a pre-defined threshold.