Malicious JavaScript detection is an important task in web security, and the quality of code representation directly affects the effectiveness of downstream classification. While traditional lexical features are simple and efficient, they may be limited in capturing broader contextual and semantic relationships in code. Recent pre-trained language models provide a new way to obtain semantic representations, but their practical utility for malicious JavaScript detection remains insufficiently studied. In this paper, we present a lightweight and unified framework to examine the effectiveness of LLM-based semantic representations for malicious JavaScript detection. Under the same preprocessing, classification, and evaluation settings, JavaScript samples are encoded using MiniLM embeddings and compared with a term frequency-inverse document frequency (TF-IDF) baseline through a Logistic Regression classifier. The results show that the MiniLM-based representation outperforms the TF-IDF baseline on all evaluation metrics, achieving 99.5% in Accuracy, Precision, Recall, and F1-score. The visualization results further suggest that the semantic representation induces a more discriminative feature space than the lexical baseline. These findings indicate that pre-trained semantic embeddings can provide useful representational advantages for malicious JavaScript detection.

JavaScript’s ubiquity in modern software makes it a frequent target for security attacks. JavaScript’s dynamic features complicate detecting the vulnerabilities. Static analysis tools are costly and error-prone, while general-purpose pretrained models fail to capture vulnerability-specific structures. We propose VulJSFormer, a novel framework for JavaScript vulnerability detection. At its core, we introduce the Vulnerability-Relevant Code Property Graph (VR-CPG), which retains subgraphs anchored at sources and sinks to discard redundant information while preserving security-critical dependencies. Built on Graph Transformers and trained under a pretraining–fine-tuning paradigm, our model learns both general semantic patterns and vulnerability-specific features. Experiments show that VulJSFormer achieves an F1 score of 74.8%, outperforming state-of-the-art JavaScript vulnerability detection tools ODGen and FAST by 20.1% and 9.8%, respectively. It also surpasses strong pretrained baselines such as GraphCodeBERT, despite using fewer parameters. These results highlight both the effectiveness and efficiency of VulJSFormer, opening a new direction for neural network–based approaches to JavaScript vulnerability detection. Index Terms—JavaScript vulnerability detection, code property graph, graph transformer, self-supervised pretraining, program representation learning

Browser fingerprinting is a stateless tracking technique that poses a significant security threat to users' privacy. However, the distinction between fingerprinting and nonfingerprinting scripts is far from well-defined, making the detection of fingerprinting scripts very challenging. Existing methods for detecting browser fingerprinting are based on heuristics or machine learning, and thus either require strictly defined rules or are not able to learn the features of fingerprinting scripts comprehensively, failing to detect a significant fraction of fingerprinting scripts. To detect browser fingerprinting more effectively, we propose a deep learning-based detection method, DeepFPD , in which multiple script modalities including tokens, abstract syntax trees, and control flow graphs are learned by using different specific neural networks to obtain lexical, syntax, and control flow information of the script code. Moreover, the attention mechanism is introduced to enhance the effectiveness of DeepFPD . The experimental results on the training dataset and test dataset constructed based on real-world scripts show that DeepFPD outperforms the state-of-the-art work with an F1-measure improvement of 8.3% and 18.7%, respectively.

Due to the convenience and popularity of Web applications, they have become a prime target for attackers. As the main programming language for Web applications, many methods have been proposed for detecting malicious JavaScript, among which static analysis-based methods play an important role because of their high effectiveness and efficiency. However, obfuscation techniques are commonly used in JavaScript, which makes the features extracted by static analysis contain many useless and disguised features, leading to many false positives and false negatives in detection results. In this paper, we propose a novel method to find out the essential features related to the semantics of JavaScript code. Specifically, we develop JSRevealer, a robust, effective, scalable, and interpretable detector for malicious JavaScript. To test the capabilities of JSRevealer, we conduct comparative experiments with four other state-of-the-art malicious JavaScript detection tools. The experimental results show that JSRevealer has an average F1 of 84.8% on the data obfuscated by different obfuscators, which is 21.6%, 22.3%, 18.7%, and 22.9% higher than the tools CUJO, ZOZZLE, JAST, and JSTAP, respectively. Moreover, the detection results of JSRevealer can be interpreted, which can provide meaningful insights for further security research.

Machine learning is increasingly being applied to malicious JavaScript detection in response to the growing number of Web attacks and the attendant costly manual identification. In practice, to hide their malicious behaviors or protect intellectual copyrights, both malicious and benign scripts tend to obfuscate their own code before uploading. While obfuscation is beneficial, it also introduces some additional code features (e.g., dead code) into the code. When machine learning is employed to learn a malicious JavaScript detector, these additional features can affect the model to make it less effective. However, there is still a lack of clear understanding of how robust existing machine learning-based detectors are on different obfuscators. In this paper, we conduct the first empirical study to figure out how obfuscation affects machine learning detectors based on static features. Through the results, we observe several findings: 1) Obfuscation has a significant impact on the effectiveness of detectors, causing an increase both in false negative rate (FNR) and false positive rate (FPR), and the bias of obfuscation in the training set induces detectors to detect obfuscation rather than malicious behaviors. 2) The common measures such as improving the quality of the training set by adding relevant obfuscated samples and leveraging state-of-the-art deep learning models can not work well.3) The root cause of obfuscation effects on these detectors is that feature spaces they use can only reflect shallow differences in code, not about the nature of benign and malicious, which can be easily affected by the differences brought by obfuscation. 4) Obfuscation has a similar effect on realistic detectors in VirusTotal, indicating that this is a common real-world problem.