混淆恶意JavaScript代码的检测与反混淆方法研究

Detecting and De-Obfuscating Obfuscated Malicious JavaScript Code

针对混淆恶意JavaScript代码很难被检测以及很难被反混淆的问题,深入分析了混淆JavaScript代码的外部静态行为特征和内部动态运行特征.提出一种检测混淆与反混淆方法,设计并实现了一个原型系统.系统通过静态分析检测混淆,通过动态分析进行反混淆.静态分析只使用正常行为数据进行训练,采用主成分分析(PCA)、单分类支持向量机(One Class SVM)和最近邻(K-NN)算法检测混淆.动态分析分为两个步骤:首先遍历混淆代码抽象语法树(Abstract Syntax Tree)的节点;其次根据节点类型跟踪并分析节点上的相关变量,利用相关的变量终值进行反混淆.从真实环境中收集了总数为80 574条JavaScript正常与混淆恶意代码用于测试.大量的实验结果表明,在选用主成分分析算法时,在误报率为0.1%时,系统对混淆恶意JavaScript代码的检测率能达到99.90%.与此同时,文中提出的反混淆方法对超过80%的混淆代码能进行有效反混淆.

Obfuscated malicious JavaScript code is How to effectively and efficiently detect and de very difficult to be detected and to be de-obfuscated. obfuscate obfuscated malicious JavaScript code is thus an emerging and crucial issue. In order to dealing with the issue, in this paper, we analyze in-depth a big number of static outer and dynamic inner features of obfuscation, and accordingly extract effective static and dynamic features from obfuscation. A prototype system for the detection of obfuscation based on anomaly detection techniques and for the de-obfuscation based on variable analysis is designed, which combines static analysis and dynamic analysis of JavaScript codes. Static analysis is used mainly for the detection of obfuscated malicious JavaScript code while dynamic analysis is used for the de-obfuscation. In static analysis, only benign samples are used in training phase. Three machine learning algorithms are employed, namely, Principal Component Analysis （PCA）, One-Class Support Vector Machine （OCSVM） and K-Nearest Neighbor （K-NN）, to detect the obfuscation of malicious JavaScript code. In dynamic analysis, two steps are followed. Nodes of JavaScript Syntax Tree （AST） are first tracked and the related variable final values associated with the node types are then used to de-obfuscate. 80574 JavaScript-based pages are collected in a real network environment for validating our methods.Extensive experimental results demonstrate achieves a detection rate as 99.90% with a false positive rate as 0.1% for detecting obfuscation. Meanwhile, our de-obfuscation approach automatically de-obfuscates obfuscations with accuracy of more than 80%.