基于JavaScript的轻量级恶意网页异常检测方法

Lightweight method for detecting JavaScript-based malicious Web pages

为了有效检测恶意Web网页,提出一种基于JavaScript代码基本词特征的轻量级分析方法.首先利用抓捕器获取页面中的全部源代码并从中分离出JavaScript代码,再将全部JavaScript代码用自定义的基本词表示,然后利用最近邻(K-NN)、主成分分析(PCA)和支持向量机(One-class SVM)等三种机器学习算法通过异常检测模式检测恶意网页.实验结果表明:每种算法的检测时间开销都较小,当选用PCA算法时,检测系统在1%误报率的情况下能达到90%的检测率,同时检测系统对网页的平均有效检测速率达250s-1.

In order to detect malicious Web pages efficiently ,a lightweight analysis method was pro-posed based on basic JavaScript code words .First ,crawler got all source codes from Web pages ,and then extracted JavaScript codes from source codes .Second ,self-defined basic code words replaced all JavaScript codes .Last ,three machine learning algorithms ,namely ,K-nearest neighbor (K-NN ) , principal component analysis (PCA ) as well as one-class support vector machine (SVM ) were em-ployed to detect malicious Web pages based on anomaly detection .The extensive experimental results show that our method can detect Web pages efficiently .In particular ,PCA achieves a detection rate as 90% with false positive rate of 1% ,detecting 250 s-1 .