Exploring LLM-Based Representations for Malicious JavaScript Detection

Malicious JavaScript detection is an important task in web security, and the quality of code representation directly affects the effectiveness of downstream classification. While traditional lexical features are simple and efficient, they may be limited in capturing broader contextual and semantic relationships in code. Recent pre-trained language models provide a new way to obtain semantic representations, but their practical utility for malicious JavaScript detection remains insufficiently studied. In this paper, we present a lightweight and unified framework to examine the effectiveness of LLM-based semantic representations for malicious JavaScript detection. Under the same preprocessing, classification, and evaluation settings, JavaScript samples are encoded using MiniLM embeddings and compared with a term frequency-inverse document frequency (TF-IDF) baseline through a Logistic Regression classifier. The results show that the MiniLM-based representation outperforms the TF-IDF baseline on all evaluation metrics, achieving 99.5% in Accuracy, Precision, Recall, and F1-score. The visualization results further suggest that the semantic representation induces a more discriminative feature space than the lexical baseline. These findings indicate that pre-trained semantic embeddings can provide useful representational advantages for malicious JavaScript detection.