A deep learning approach for detecting malicious JavaScript code

Security and Communication Networks

Volumn 9, Issue 11, 2016, Pages 1520-1534

  Wang, Yao ^a   Cai, Wan Dong ^a   Wei, Peng Cheng ^a  

^a NORTHWESTERN POLYTECHNICAL UNIVERSITY   (China)

Author keywords

deep learning; JavaScript attacks; logistic regression; random projection; SdA; static analysis

Indexed keywords

BIG DATA; CODES (SYMBOLS); COPYRIGHTS; HIGH LEVEL LANGUAGES; REGRESSION ANALYSIS; STATIC ANALYSIS;

FALSE POSITIVE RATES; INFORMATION TRANSMISSION; JAVASCRIPT; LEARNING FRAMEWORKS; LOGISTIC REGRESSIONS; MALICIOUS JAVASCRIPT; RANDOM PROJECTIONS; SPARSE RANDOM PROJECTIONS;

DEEP LEARNING;

EID: 84958231548     PISSN: 19390114     EISSN: 19390122     Source Type: Journal    
DOI: 10.1002/sec.1441     Document Type: Article

References (34)

1. Symantec. Internet security threat report: trends for 2013. vol. 19, Symantec Inc., 2014.
2. th Int. Conf. on World Wide Web, New York, USA, 2010; pp. 281–290.
3. Schwenk G, Bikadorov A, Krueger T, Rieck K. Autonomous learning for detection of JavaScript attacks: vision or reality?. In Proc. AISec., Raleigh, North Carolina, USA, Oct. 19, 2012; pp. 93–104.
4. rd USENIX Security Symposium, San Diego, CA, Aug. 2014; pp. 641–654.
5. Alazab M, Venkatraman S, Watters P, Alazab M. Information security governance: the art of detecting hidden malware. In IT Security Governance Innovations: Theory and Research, Mellado D, Sánchez L, FernándezMedina E, Piattini M (eds). IGI Global: headquartered in Hershey, Pennsylvania (USA), 2012; pp. 293–315.
6. th International Conference on Malicious and Unwanted Software (MLWARE), Oct., 2009; pp. 47–54.
7. Fraiwan M, Al-Salman R, Khasawneh N, Conrad S. Analysis and identification of malicious JavaScript code. Information Security Journal: A Global Perspective 2012; 21(1):1–11.
8. th USENIX Conf. on Security, Aug. 2011.
9. th Annual Computer Security Applications Conference, Austin, Texas, USA, Dec. 2010, pp. 31–39.
10. Kim HG, Kim DJ, Cho SJ, Park MJ, Park MY. Efficient detection of malicious web pages using high-interaction client honeypots. Journal of Information Science and Engineering 2012; 28(5):911–924.
11. Alosefer Y, Rana O. Honeyware: a web-based low interaction client honeypot. The Third Int. Conf. On Software Testing, Verification, and Validation, Paris, France, April 2010; pp. 410–417.
12. Egele M, Kirda E, Kruegel C. Mitigating drive-by-download attacks: challenges and open problems. IFIP WG 11.4 International Workshop, Zurich, Switzerland, April 2009; pp. 52–62.
13. Ratanaworabhan P, Livshits B, Zorn B. Nozzle: a defense against heap-spraying code injection attacks. In Proc. of USENIX Security Symposium, 2009; pp. 169–186.
14. Canali D, Cova M, Vigna G, Kruegel C. Prophiler: a fast filter for the large-scale detection of malicious web pages. In Proc. of the Int. World Wide Web, Hyderabad, India, 2011; pp. 197–206.
15. Alazab M, Venkatraman S, Watters P, Alazab M. Zero-day malware detection based on supervised learning algorithms of API call signatures. AusDM' 11 Proc. of the Ninth Australasian Data Mining Conference, vol. 121, pp. 171–182.
16. Huda M, Abawajy J, Alazab M, Abdollalihian M, Islam R, Yearwood J. Hybrids of support vector machine wrapper and filter based framework for malware detection. Future Generation Computer Systems 2014. doi:10.1016/j.future.2014.06.001.
17. Alazab M. Profiling and classifying the behavior of malicious codes. Journal of Systems and Software 2015; 100:91–102.
18. AL-Taharwa IA, Lee H, Jeng AB, Wu K, Ho C, Chen S. JSOD: JavaScript obfuscation detector. Security Comm. Networks 2015; 8:1092–1107. doi:10.1002/sec.1064.
19. rd USENIX Security Symposium, San Diego, CA, Aug. 2014; pp. 625–640.
20. Bengio Y, Lamblin P, Popovici D, Larochelle H. Greedy layer-wise training of deep networks. In Proc. Neural Inf. Process. Syst., Cambridge, MA, USA, 2007; pp. 153–160.
21. LeRoux N, Bengio Y. Deep belief networks are compact universal approximators. Neural Computation 2010; 22(8):2192–2207.
22. LeCun Y, Bottou L, Bengio Y, Haffner P. Gradient-based learning applied to document recognition. Proceedings of the IEEE 1998; 86:2278–2324.
23. Vincent P, Larochelle H, Lajoie I, Bengio Y, Manzagol P. Stacked denoising autoencoders: learning useful representations in a deep network with a local denoising criterion. Journal of Machine Learning Research 2010; 11(12):3371–3408.
24. Salakhutdinov R, Hinton GE. Deep Boltzmann machines. In Proc. Int. Conf. Artif. Intell. Statist, Clearwater Beach, FL, USA, 2009; pp. 448–455.
25. Hinton GE, Osindero S, The Y. A fast learning algorithm for deep belief nets. Neural Computation 2006; 18(7):1527–1554.
26. nd Annual Meeting of the Association for Computational Linguistics, Maryland, USA, June 2014; pp. 721–732.
27. Glorot X, Bengio Y. Understanding the difficulty of training deep feedforward neural networks. Proc. Int. Conf. Artificial Intelligence and Statistics, Chia Laguna Resort, Sardinia, Italy, 2010; pp. 249–256.
28. Softmax regression. http://deeplearning.stanford.edu/wiki/index.php/Softmax_Regression, accessed 7 April 2014.
29. Heritrix. http://crawler.archive.org/index.html.
30. th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, New York, USA, 2006; pp. 287–296.
31. Kazemian HB, Ahmed S. Comparisons of machine learning techniques for detecting malicious webpages. Expert Systems with Applications 2015; 42(3):1166–1177.
32. Shyu M, Chen S, Sarinnapakom K, Chang L. A novel anomaly detection scheme based on principal component classifier. In Proc. of the IEEE Foundations and New Directions of Data Mining Workshop, Melbourne, Florida, USA, Nov. 2003; pp. 172–179.
33. Hyvarinen A, Oja E. Independent component analysis: algorithms and applications. Neural Networks 2000; 13(4-5):411–430.
34. Yong AG, Pearce S. A beginner's guide to factor analysis: focusing on exploratory factor analysis. Tutorials in Quantitative Methods for Psychology 2013; 9(2):79–94.