As a crucial component of websites, JavaScript is one of the most common attack payloads on malicious websites. Although many methods for detecting malicious JavaScript have been proposed, obfuscation techniques make it difficult for previous approaches to detect disguised malicious JavaScript effectively. To address this problem, we observe that malicious JavaScript often uses obfuscation to fragment key attack semantics and conceal them within data-dependent statements involving variable propagation. This observation suggests that data dependencies between variables can be leveraged to extract potentially malicious functional statements. Therefore, this paper proposes JSCoherence, a novel static detection method for obfuscated malicious JavaScript. Its core principle is to mine statement pairs with data dependencies through data-flow analysis, thereby reconnecting fragmented semantics and recovering locally coherent malicious behavior. Experiments show that JSCoherence achieves an F1 score of 99.77
原文链接
分享
引用
