Earticle

초록

영어

Recently, most of malicious web pages include obfuscated codes in order to circumvent the detection of signature-based detection systems .It is difficult to decide whether the sting is obfuscated because the shape of obfuscated strings are changed continuously. In this paper, we propose a novel methodology that can detect obfuscated strings in the malicious web pages. We extracted three metrics as rules for detecting obfuscated strings by analyzing patterns of normal and malicious JavaScript codes. They are N-gram, Entropy, and Word Size. N-gram checks how many each byte code is used in strings. Entropy checks distributed of used byte codes. Word size checks whether there is used very long string. Based on the metrics, we implemented a practical tool for our methodology and evaluated it using read malicious web pages. The experiment results showed that our methodology can detect obfuscated strings in web pages effectively.

목차

Abstract
 1. Introduction
 2. Related Work
 3. Our Methodology for Detecting Obfuscation in Malicious Web Pages
 4. Extraction of Obfuscated Strings in JavaScript
  4.1. JavaScript String Classification
  4.2. Extraction of Obfuscated String using Static Data Flow Analysis
 5. Detection of Obfuscated Strings in JavaScript Codes
  5.1. Metrics for Detecting Obfuscated Strings
  5.2. Evaluation and Experiments
 6. Conclusion and Future Work
 References

키워드

저자

• YoungHan Choi [ The Attached Institute of ETRI ]
• TaeGhyoon Kim, [ TaeGhyoon Kim | The Attached Institute of ETRI ]
• SeokJin Choi [ The Attached Institute of ETRI ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Security and Its Applications

• 간기

  격월간

• pISSN

  1738-9976

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605