JaSt: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript

• Published in: Detection of Intrusions and Malware, and Vulnerability Assessment Vol. 10885; pp. 303 - 325
• Main Authors: Fass, Aurore, Krawczyk, Robert P., Backes, Michael, Stock, Ben
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2018; Springer International Publishing
• Series: Lecture Notes in Computer Science
• Subjects: JavaScript Instance; Low False Negative Rate; Malicious JavaScript; Malware; Sample JavaScript
• ISBN: 3319934104; 9783319934105
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-319-93411-2_14

JavaScript is a browser scripting language initially created to enhance the interactivity of web sites and to improve their user-friendliness. However, as it offloads the work to the user’s browser, it can be used to engage in malicious activities such as Crypto Mining, Drive-by Download attacks, or redirections to web sites hosting malicious software. Given the prevalence of such nefarious scripts, the anti-virus industry has increased the focus on their detection. The attackers, in turn, make increasing use of obfuscation techniques, so as to hinder analysis and the creation of corresponding signatures. Yet these malicious samples share syntactic similarities at an abstract level, which enables to bypass obfuscation and detect even unknown malware variants. In this paper, we present JaSt, a low-overhead solution that combines the extraction of features from the abstract syntax tree with a random forest classifier to detect malicious JavaScript instances. It is based on a frequency analysis of specific patterns, which are either predictive of benign or of malicious samples. Even though the analysis is entirely static, it yields a high detection accuracy of almost 99.5% and has a low false-negative rate of 0.54%.