-In this paper, we consider JavaScript code obfuscation detection using artificial neural network with attention mechanism as classifier algorithm. Obfuscation is widely used by malware writers that want to obscure malicious intentions, e.g. exploit kits, and also it is a common component of intellectual property protection systems. Non-obfuscated JavaScript code samples were obtained from software repository service Github.com. Obfuscated JavaScript code samples were created by obfuscators found on the same service. Before being fed to the network, each JavaScript program is converted to the general path-based representation, i.e. each program is described by the set of paths in an abstract syntax tree. Model proposed in this paper is a feedforward artificial neural network with attention mechanism. We aimed to build a model that relies on AST paths structures instead of statistical features. According to results of experiments, evaluated model potentially can be implemented with some improvements in malicious code detection systems, browser or mobile device fingerprint collection systems etc.
INTRODUCTION
According to Varnovsky et al. statements [
By Han Liu et al. obfuscation is defined as special program
transformation whose purpose is to obscure source code or
binary code in order to hide implemented algorithms and data
structures from being recovered [
Schrittwieser et al. remark, that at the beginning of the
computer era obfuscation was commonly used, in particular, to
surprise users by displaying unexpected messages, but today
obfuscation is mostly used to protect intellectual property or
obscure malicious intentions [
II.
Obfuscated and non-obfuscated programs distinguishing
problem is indelibly linked to the source code properties
prediction and various programs classification types. To
formalize the problem, we will use the definitions introduced
by Silveo Cesar and Yang Xiang in the first chapter of their
book "Classification and similarity of programs" [
Let r be a property for program p if for all possible execution flaws r is true. A program q is called an obfuscated copy of a program p if q is the result of transformations that preserve the semantics (meaning) of algorithms and data structures. Programs p and q are similar if they are based on the same program.
Let P be the set of source codes of programs, f1,..., fk are functions that allocate features from program, i.e. fi: P → Di, where Di is the i-th set of features. Let {p1, ... , pn} ⊂ P be the training sample, {0,1} = Y - class labels (1 is assigned to obfuscated programs, 0 is assigned to non-obfuscated). It is necessary to find the map s: D1×...×Dk → {0,1} using training sample {p1, ... , pn} that classifies all elements of P with the smallest error function value.
III.
To create a dataset with obfuscated and non-obfuscated Javascript code samples we used software repository github.com. Github.com is one of the largest service platforms that features software projects hosting and collaborative development. There were downloaded 100 most popular JavaScript projects. To get a list of the most popular projects, we used a special search API (referenced as Github Search API) provided by the service. Further all projects from the resulting list were cloned to the local machine. Downloading was done on March 22th, 2019 and all downloaded projects took up 7.3 Gb of the disk space. 49612 files with the ".js" extension (excluding files with the ".min.js" extension) were retrieved from the obtained data. In order to simplify the further creation of obfuscated code samples, it was decided to retrieve functions from scripts. An example of a simple JavaScript function is shown in fig. 1.
Node.js script that retrieves functions from a Javascript
program was written using the Esprima library. With this
library abstract syntax tree (AST) can be formed for any
Javascript program that complies with the ECMAScript 2016
standard. An abstract syntax tree for a script is formed
according to the syntactic rules of the programming language.
You can apply the inverse transformation and generate the
correct program code from the tree. Unlike to plain source
code, ASTs do not include punctuation, delimiters, comments
and some other details, but they can be used to describe the
syntactic structure of the script along with lexical information
[
There were built ASTs for all previously downloaded scripts with the extension ".js" (49612 samples) using the parseModule method provided by the Esprima API. Program code for each element of the "FunctionDeclaration" was saved into separate files during the tree traversal. Hereby 126276 files were produced, each file contained a JavaScript function, all files took up 527 Mb of the disk space.
To generate obfuscated code samples, we used special programs that implement JavaScript code obfuscation. On the mentioned above github.com software repository hosting we found 6 obfuscators that fit our needs. They are listed below: • javascript-obfuscator/javascript-obfuscator • zswang/jfogs • anseki/gnirts •
mishoo/UglifyJS2 • alexhorn/defendjs •
wearefractal/node-obf Obfuscators can work in different ways. Some obfuscators do not significantly change the syntactic structure of the program, e.g. jfogs and UglifyJS2, and mostly rename some identifier and shuffle independent parts. Other obfuscators, such as gnirts or defendjs, completely change the syntactic structure of the scripts.
PigeonJS library was used to extract features from the
JavaScript programs source codes [
One path on the AST formed by PingeonJS has following
structure called general path-based representation [
The vertices are separated by v and ^ depending on whether the left vertex is higher or lower on the tree in comparison with right one. One of the paths retrieved from the basic JavaScript program example (fig. 1) is shown in fig. 3.
Not all scripts have been obfuscated with all of obfuscators listed before and contexts were retrieved not from all programs. Main purpose for this was that some of the downloaded JavaScript files contained programs that have nonstandard features and extensions. Besides, some obfuscated scripts took up to 1Gb file storage space although original scripts had size up to 200-300 Kb. We decided to take such samples away from the dataset.
IV.
NEURAL NETWORK ARCHITECTURE
The architecture of an artificial neural network was used in
this study is based on the network, proposed by Uri Alon et al.
in their paper "code2vec: Learning Distributed Representations
of Code" [
Main objects the network is working on are script contexts. The context si = (xs, p, xt) is a tuple containing three elements: the start vertex, the path, and the terminal vertex. Start vertex xs and terminal vertex xt are elements of the start and terminal vertices set T. Path p is an element of the paths set P. Every JavaScript program (it does not matter, is it obfuscated or nonobfuscated) is described with a set of contexts:
Each element x of the vertices set T has its own vector representation vx in VectT (128-dimensional rational vector). Similarly, each element p of the paths set P has its own vector representation vp in VectP (128-dimensional rational vector). In that way each context has 384-dimensional vector representation that looks like this:
Then each script is described by a tuple of contexts vector representations:
Maximum number of contexts per script was 200. If there were less then 200 contexts for some script then contexts tuple was padded with zero-filled contexts: Artificial neural network architecture used in this research is shown in fig. 4. First of all, there is fully connected layer to which Dropout regularization method was applied. Thanks to this 75% randomly chosen neurons are ignored (not considered during forward pass) on each epoch. This helps to prevent over-fitting of training data and increases model performance on non-observed samples.
Fully connected layer have tanh activation function: where
is a context vector representation, is a combined context vector representation (2) (3) (4) (5) (6)
is a fully connected layer weights matrix.
Based on the combined contexts {d1, ... , d200} and the attention vector α, the attention weights αi are calculated for each di. Vector α is initialized with random variables and updated during the training.
Obviously, the sum of all αi equals 1. After that a code vector v is calculated using the attention weights αi as follows:
Since all attention weights αi are nonnegative, and their sum equals to 1, we can consider the calculation of the code vector as the calculation of the weighted average over all combined contexts di.
The idea behind the attention mechanism can be described
as choosing the most interesting part of the resulting set. The
softmax transformation (7) is a key component of several
statistical learning models but recently it has also been used to
design attention mechanisms in neural networks [
At the last step the final solution is calculated using 128dimensional real vectors yobf and ynotobf: obfuscated or nonobfuscated script was passed to the network input. Vectors yobf and ynotobf are initialized randomly and updated during model training. JavaScript program obfuscation probability q(v) is calculated based on code vector (7): (7) (8) If q(v) > 0.5 then script is thought to be obfuscated. Script non-obfuscation probability is estimated as 1−q(v) respectively. For one script, the loss function (cross-entropy function) is computed as follows: where p(v) = 1 for obfuscated scripts and p(v) = 0 for nonobfuscated scripts. To minimize the loss function, the method of adaptive moment estimation (Adam) was used as an optimization algorithm.
MODEL TRAINIG AND EVALUATION
Model training and evaluation were proceeded on the workstation with the following equipment: Intel Core i7-7700 processor (3.6 GHz) with 8 cores, 16 GB of RAM, NVIDIA GeForce GTX 1080 GPU. The training dataset was formed as follows: 115504 context samples describing non-obfuscated functions and 117990 context samples describing obfuscated functions, among them 36000 randomly chosen from all samples obfuscated with "javascript-obfuscator" , 36000 randomly chosen from all samples obfuscated with "jfogs", 36000 randomly chosen from all samples obfuscated with "UglifyJS2" and 9990 – from samples obfuscated with "defendjs". There were 233494 context samples in sum.
A set Tp (|Tp|=776830) of the most popular names of start and final context vertices and a set Pp (|Pp|=1008102) were obtained from the training sample so that for each script s at least one context c contains two elements from T and one element from P.
Testing dataset contained 8444 contexts describing obfuscated functions (7655 samples obfuscated with "gnirts" and 789 samples obfuscated with "jfogs") and 8444 contexts describing non-obfuscated functions.
We decided to use precision (10), recall (11) and F1-score (12) as model evaluation metrics explaining model performance.
Model training was 9 epochs long. Precision, recall and F1score obtained after model training completion are shown in Table 1. (9) (10) (11) (12) (13)
Metric Precision Recall F1
Our model showed less well performance than the model
proposed by Tellenbach et. al. Their model used features
reflecting the frequencies of JavaScript keywords and other
statistical statistical calculations and had following evaluations:
precision – 95%, recall – 90%, F1-score – 92% [
At the same time the presented model has sufficient improvement potential gives rise to further research of obfuscation detection models that do not rely on pre-calculated statistical features. First of all, second fully connected layer and activation function replacement with different one could positively impact model quality scores.
Beyond that, code vector v (7) can be passed to additional
classifier input, e.g. SVM-based or Random Forest based. A
similar approach Ndichu et al. proposed to solve the JavaScript
malware detection problem using feedforward neural network
[
VI.
In this paper we explored JavaScript (ECMAScript 2016) code obfuscation detection method that uses artificial neural network with attention mechanism as classifier algorithm.
First of all, a set of samples of obfuscated and nonobfuscated code was obtained using projects and repositories hosted on github.com. Secondly, an artificial neural network model with an attention mechanism was adapted to solve the problem of scripts classification on the obfuscation basis. Thirdly, non-obfuscated dataset could be checked for the presence of obfuscated samples uploaded to github.com repository, downloaded during the dataset preparation stage and erroneously labeled as non-obfuscated.
The characteristics of the obtained model show that the considered method potentially can be implemented with some improvements in malicious code detection systems, browser or mobile device fingerprint collection systems or other software that use obfuscation recognition.