JSOD: JavaScript obfuscation detector
Ismail Adel AL-Taharwa, Hahn‐Ming Lee, Albert B. Jeng, Kuo-Ping Wu, Cheng-Seen Ho, Shyi‐Ming Chen · Security and Communication Networks · 2014
Abstract JavaScript obfuscation is a deliberate act of making a script difficult to understand by concealing its purpose. The prevalent use of obfuscation techniques to hide malicious codes and to preserve copyrights of benign scripts resulted in (i) missing detection of malicious scripts that are obfuscated and (ii) raising false alarms due to the benign scripts that are obfuscated. Automatic detection of obfuscated JavaScript is generally undertaken by tackling the problem from the readability perspective. Recently, Microsoft research team analyzed different levels of context‐based features to distinguish obfuscated malicious scripts from obfuscated benign ones. In this work, we raise the issue of existing readable versions of obfuscated scripts. Further, we discuss the challenges posed by readably obfuscated scripts against both JavaScript malware detectors and obfuscated scripts detectors. Therefore, we propose JavaScript Obfuscation Detector (JSOD), a completely static solution to detect obfuscated scripts including readable patterns. To evaluate JSOD, we compare it to the state‐of‐the‐art approaches to detect obfuscated malicious and obfuscated benign script, namely, Zozzleand Nofus. Our experimental results demonstrate the importance to detect readably obfuscated scripts and their sophisticated variations. Furthermore, they also show the superiority of JSODapproach against all relevant solutions. Copyright © 2014 John Wiley & Sons, Ltd.