基于预过滤的恶意JavaScript脚本检测与分析方法

Detection and analysis of malicious Java Script code based on pre-filter

恶意网页利用网页木马来攻击网络用户使之成为僵尸网络中的节点,是目前互联网上较为流行的一种攻击手段。攻击者通常将Java Script编写的恶意脚本嵌入到网页中,当用户浏览该页面时,脚本执行并试图对浏览器或浏览器插件进行攻击。提出一种适用于大规模网页检测的基于预过滤的恶意Java Script脚本检测与分析方法——JSFEA,该方法使用静态检测快速扫描页面并判定网页是否为可疑页面,如果判定可疑则进行动态检测。实验表明,JSFEA对恶意网页的误报率很低,并减少了85%以上的页面进行动态检测,大大提高了大规模恶意网页检测效率。

Malicious Web pages that host drive-by-download exploits have become the popular means for compromising hosts and creating botnets on the Internet. In drive-by-download exploits, attackers embed malicious JavaScript code into a Web page. When a victim visits this page, the script is executed and attempts to compromise the browser or one of its plugins. This paper proposed a detection and analysis method of malicious JavasScript code based on pre-filter called JSFEA which suits for large-scale Web page detection. JSFEA used static analysis techniques to quickly examine a Web page for determining whether it”s suspicious or not. If it is determined suspicious then put it into dynamic detection. The study shows that JSFEA is able to reduce the load on a more costly dynamic analysis by more than 85%, with a low false positive rate.