深度学习对抗恶意脚本：JavaScript与VBScript的神经分类研究

版权申诉

72 浏览量更新于2024-07-19 收藏 1.74MB PDF 举报

"基于神经网络的恶意脚本分类：JavaScript与VBScript研究" 在这个深度学习应用于网络安全领域的研究中，"NeuralClassificationofMaliciousScripts"探讨了如何利用神经网络技术来有效地识别和区分JavaScript和VBScript两种常见的恶意脚本。JavaScript和VBScript作为Web脚本语言，由于其广泛的应用，成为了网络攻击的重要载体。随着JavaScript攻击的日益增多，传统的安全措施已不足以应对这种威胁。研究人员提出了两种深度递归模型——LaMP（长短时记忆网络和最大池化）和CPoLS（长序列卷积分割），以处理这两种脚本的字节序列。LaMP模型通过下层捕捉字节序列的顺序特性，而上层则负责将处理后的嵌入向量分类为恶意或良性。这种方法不同于以往仅依赖特征提取的方案，它采用端到端的学习方式，使得模型能够进行更精细的区分和决策。通过这种神经网络架构，模型能够学习到脚本中的模式和潜在威胁，提高对恶意代码的检测准确性和效率。这不仅有助于减少误报，还能在实时监控中及时发现并阻止恶意脚本的执行，从而保护用户的计算机系统免受攻击。该研究的贡献在于创新的模型设计和训练策略，为恶意脚本分类提供了一种更有效的方法，对于网络安全专业人员来说，理解和应用这些模型对于提升防御能力具有实际价值。在未来，随着深度学习技术的进一步发展，此类研究可能会推动恶意脚本检测技术的持续改进和前沿发展。

Stokes et al.

2014

2015

2016

2017

VBS

Percent of Annual Number

of Detec�ons (%)

Figure 3: Percentage of malicious ﬁles

detected by the Windows Defender anti-

malware engine over time in the categories

of JavaScript and VBScript attacks.

HTML

VBS

Exploit

Macro

PowerShell

Other Non-PE

Percent of Total Detections in 2017

Figure 4: Percentage of total detections by

ﬁle type in 2017. The remaining 92.5% of

detections were for PE ﬁles.

• We investigate two deep recurrent neural network models for the detection of malicious

JavaScript and VBScript.

• We evaluate these models on two large corpora of JavaScript and VBScript ﬁles.

2. Motivation

The detection of malicious JavaScript and VBScript is important for protecting users against

modern malware attacks. With advances in browser and operating system security making

browser exploit attacks more diﬃcult, miscreants are instead relying on social engineering

attacks. Figure 3 illustrates the percentage of malicious detected ﬁles by the Windows

Defender anti-malware engine in the categories of JavaScript and VBScript attacks. The

percentage of malicious JavaScript-based attacks has been rising recently, while the percent-

age of detected attacks involving VBScript have remained relatively constant since 2014.

Figure 4 indicates the percentage of all, non-PE ﬁles detected in the Windows Defender

telemetry. This ﬁgure indicates that JavaScript and VBScript are the two most prevalent

types of detected scripts found in the telemetry data. Since the remaining 92.5% of the

detections are for PE ﬁles, malicious scripts are still a small minority of the detected ﬁles

in the wild.

Based on the identiﬁed arrival methods of malicious JavaScript and VBScript, Figure 5

illustrates the identiﬁed attack methods based on the telemetry data from 2017. Archive

ﬁle detections, the most prevalent threat vector for JavaScript, are generated when the

user extracts the script from within an archive and are often used in social-engineering

attacks. Interestingly, removable drives (e.g., thumbdrives, external USB harddrives) were

responsible for the second most JavaScript attacks. Only 11.1% of detected malicious

JavaScript ﬁles were encountered from malicious email, and 3.8% of the ﬁles were directly

downloaded from the internet.

The distribution of the attack sources for malicious VBScript tells a diﬀerent story. The

main threat vector of malicious VBScript is emails followed closely again by downloads.

Archives and removable drives play a smaller role in VBScript attacks, but they are still

important threat vectors.

剩余19页未读，继续阅读

Fun_He

粉丝: 18
资源: 104

深度学习对抗恶意脚本：JavaScript与VBScript的神经分类研究

ifix入门.pdf

SCADA系统资料整理.pdf

基于人工神经网络的恶意网络流量检测技术-准确、鲁棒、精确

Linux----dhcp脚本----vsftpd脚本----mysqld脚本.........DNS脚本------samba脚本

selenium-server-standalone-3.141.59.jar 下载

photoshop-vbs-ref-2020.pdf

nohup jupyter notebook --ip=0.0.0.0 --no-browser --allow-root > jupyter.log 2>&1 & 与lsof -i:8888 执行并打印此命令的shell脚本

常见的文件扩展名以及类型

pig-0.17.0.tar.gz

最新资源