JACLNet:Application of adaptive code length network in JavaScript malicious code detection

Area of Science:

• Computer Science
• Cybersecurity
• Machine Learning

Background:

• Existing deep learning methods struggle with JavaScript malicious code detection for variable code lengths (too long or too short).
• Need for advanced detection techniques to address limitations in current JavaScript malware analysis.

Purpose of the Study:

• To propose an adaptive deep learning network, JACLNet, for effective JavaScript malicious code detection.
• To improve the detection of JavaScript code with variable lengths by capturing association features.
• To enhance feature extraction using an abstract syntax tree recombination algorithm.

Main Methods:

• Developed JACLNet, integrating a convolutional block (RDCNet), BiLSTM, and Transformer for variable code length analysis.
• Implemented an abstract syntax tree recombination algorithm to enrich syntax information for feature extraction.
• Utilized a deep residual convolution block network (RDCNet) to capture short-distance code association features.

Main Results:

• JACLNet achieved high F1-scores: 98.87% on long code (DB_Long) and 97.32% on short code (DB_Short), surpassing JSContana.
• Abstract syntax tree recombination improved F1-scores by 1.72% (DPCNN+BiLSTM), 1.50% (JSContana), and 1.00% (JACNet) on original datasets.
• Demonstrated JACLNet's effectiveness in detecting JavaScript malicious code across diverse dataset lengths.

Conclusions:

• JACLNet effectively detects JavaScript malicious code, particularly excelling with variable code lengths.
• The abstract syntax tree recombination algorithm significantly enhances feature extraction and model performance.
• The proposed method offers a robust solution for improving cybersecurity against JavaScript-based threats.