基于CB-Attention的JavaScript恶意混淆代码检测方法  

JavaScript malicious obfuscation code detection method based on CB-Attention

作　　者：徐鑫 张志宁 吕云山[3] 李立[4] 郑玉杰[5] XU Xin;ZHANG Zhi-ning;LYU Yun-shan;LI Li;ZHENG Yu-jie(Engineering Training Center,Chongqing College of Mobile Communication,Chongqing 401520,China;Chongqing Key Laboratory of Public Big Data Security Technology,Chongqing College of Mobile Communication,Chongqing 401520,China;College of Computer and Information Science,Southwest University,Chongqing 400065,China;School of Communication and Information Engineering,Chongqing University of Posts and Telecommunications,Chongqing 400065,China;School of Energy and Power Engineering,Chongqing University,Chongqing 400065,China)

机构地区：[1]重庆移通学院实训中心,重庆401520 [2]重庆移通学院公共大数据安全技术重庆市重点实验室,重庆401520 [3]西南大学计算机与信息科学学院,重庆400065 [4]重庆邮电大学通信与信息工程学院,重庆400065 [5]重庆大学能源与动力工程学院,重庆400065

出　　处：《计算机工程与设计》2024年第8期2298-2305,共8页Computer Engineering and Design

基　　金：国家自然科学基金项目(12004057);重庆市自然科学基金面上基金项目(CSTB2022 NSCQ-MSX1183)。

摘　　要：当今JavaScript代码混淆方法日益多样,现有检测方法在对混淆代检测时会出现漏报和误报的情况,为解决该问题,提出一种基于CB-Attention的JavaScript恶意代码检测方法。由SDPCNN模型和BiLSTM+Attention模型构成,SDPCNN对短距离间的语义特征信息进行提取,BiLSTM+Attention获取JavaScript代码中长距离间的语义信息特征。为验证所提方法的有效性,将该方法与其它方法进行对比,对比结果表明,该方法具有较好的检测效果,F1-Score可达98.78%。Nowadays,JavaScript code obfuscation methods are becoming more and more diverse,and the existing detection methods show miss and false positives when detecting obfuscation agents.To solve this problem,a JavaScript malicious code detection method based on CB-Attention was proposed.The model was mainly composed of SDPCNN model and BiLSTM+Attention model.SDPCNN was used to extract semantic feature information at short distances,while BiLSTM+Attention was used to obtain semantic information features at long distances in JavaScript code.To verify the effectiveness of the proposed method,the method was compared with other methods.The comparison results show that the method has better detection effects,and the F1-Score can reach 98.78%.

关 键 词：JavaScript恶意代码 混淆代码 检测模型 增强深度金字塔卷积神经网络 注意力网络 双向长短时记忆网络 长距离特征信息 抽象语法树 

分 类 号：TP390.5[自动化与计算机技术—计算机应用技术]