Research On The Methods For Javascript Malicious Code Detection

JavaScript, as a programming/scripting language, has been widely used in web development to add more dynamic features and effects, and ultimately improve user’s experience. Because of its dynamic characteristics, the security issues have been a serious problem in the interaction process between user and web sites. By injecting malicious JavaScript code, some uncertain contents could be hidden in the web page, viruses or Trojans could be spread, and phishing attacks can be achieved. Thus, JavaScript malicious detection has been a serious problem in the information security field.The present detection technology of JavaScript malicious code at home and abroad is reviewed in this article. Through the studies of numerous malicious codes in web pages, the technical characteristics and types of malicious code are introduced in detail.With the summaries of JavaScript malicious codes’characteristics and types, a JavaScript malicious code detection approach based on multi-type features is proposed in the article. Four kinds of features is summarized and extracted, they are basic statistical information features, features based on obfuscation techniques, technology-based, features based on redirection, and features based on exploitation. We use some classify algorithms to evaluate our approach based on these features.In order to the further analysis of JavaScript codes, the related strings and functions used in codes are reviewed in next step, and another two detection methods are proposed. The one is based on the analysis of obfuscated strings used in the codes. The other is based on the analysis of functions called in the codes.These three detect approaches are implemented on a JavaScript dataset. The effective implementation results are analyzed, and show that the three methods for JavaScript malicious code detecting achieve a good detection performance.