混淆恶意JavaScript代码的检测与反混淆方法研究

发布时间：2018-04-13 04:10

本文选题：混淆 + Web安全　；参考：《计算机学报》2017年07期

【摘要】：针对混淆恶意JavaScript代码很难被检测以及很难被反混淆的问题,深入分析了混淆JavaScript代码的外部静态行为特征和内部动态运行特征.提出一种检测混淆与反混淆方法,设计并实现了一个原型系统.系统通过静态分析检测混淆,通过动态分析进行反混淆.静态分析只使用正常行为数据进行训练,采用主成分分析(PCA)、单分类支持向量机(One Class SVM)和最近邻(K-NN)算法检测混淆.动态分析分为两个步骤:首先遍历混淆代码抽象语法树(Abstract Syntax Tree)的节点;其次根据节点类型跟踪并分析节点上的相关变量,利用相关的变量终值进行反混淆.从真实环境中收集了总数为80 574条JavaScript正常与混淆恶意代码用于测试.大量的实验结果表明,在选用主成分分析算法时,在误报率为0.1%时,系统对混淆恶意JavaScript代码的检测率能达到99.90%.与此同时,文中提出的反混淆方法对超过80%的混淆代码能进行有效反混淆.
[Abstract]:Aiming at the problem that obfuscation of malicious JavaScript code is difficult to detect and anti-obfuscation, the external static behavior characteristics and internal dynamic running characteristics of obfuscation JavaScript code are deeply analyzed.A method of detecting confusion and anti-confusion is proposed, and a prototype system is designed and implemented.The system detects confusion by static analysis and anti-confusion by dynamic analysis.Static analysis only uses normal behavior data for training. Principal component analysis (PCA), single classification support vector machine (SVM) and nearest neighbor (K-NNN) algorithm are used to detect confusion.Dynamic analysis is divided into two steps: first, traversing the node of the obfuscation code abstract syntax tree (Abstract Syntax tree); secondly, tracking and analyzing the relevant variables on the node according to the node type, and using the final values of the relevant variables to carry out anti-obfuscation.A total of 80,574 pieces of JavaScript normal and obfuscated malicious code were collected from real environment for testing.A large number of experimental results show that when the principal component analysis (PCA) algorithm is selected and the false alarm rate is 0.1, the detection rate of the confused malicious JavaScript code can reach 99.90%.At the same time, the anti-obfuscation method proposed in this paper can effectively counter-confuse more than 80% of the obfuscation codes.
【作者单位】：北京交通大学计算机与信息技术学院;石河子大学信息科学与技术学院;
【基金】：上海市信息安全综合管理技术研究重点实验室教育部高校创新团队项目(IRT201206);教育部高等学校博士学科点专项科研基金(20120009110007,20120009120010);教育部留学回国人员科研启动基金项目(K14C300020)资助博士点基金中央高校基本科研业务费专项资金(2015JBM025)
【分类号】：TP309

【相似文献】