Earticle

The cyber attacks using web sites for a personal information sale or break down the infrastructures are increasing. To prevent cyber attacks, virtual computer systems are hired and dynamic malicious web site analysis systems are used. However the dynamic analysis systems have to setting up a targeted environment and have a threat of real attack. Unlikely the dynamic analysis system, a static malicious web site analysis system can download a web page source and analysis the web page. The static analysis algorism also has problem, the analysis time is longer than dynamic systems and need a human checking. For this reason, this journal suggest new analysis system reducing the dynamic and static system's problems using suspicious malicious web site detection with strength analysis of a JavaScript obfuscation for new hybrid analysis system.

Recently, most of malicious web pages include obfuscated codes in order to circumvent the detection of signature-based detection systems .It is difficult to decide whether the sting is obfuscated because the shape of obfuscated strings are changed continuously. In this paper, we propose a novel methodology that can detect obfuscated strings in the malicious web pages. We extracted three metrics as rules for detecting obfuscated strings by analyzing patterns of normal and malicious JavaScript codes. They are N-gram, Entropy, and Word Size. N-gram checks how many each byte code is used in strings. Entropy checks distributed of used byte codes. Word size checks whether there is used very long string. Based on the metrics, we implemented a practical tool for our methodology and evaluated it using read malicious web pages. The experiment results showed that our methodology can detect obfuscated strings in web pages effectively.