Drive-by-Download JavaScript

Size: px

Start display at page:

Download "Drive-by-Download JavaScript"

せぴあいのら
5 years ago
Views:

1 JAIST Reposi Title Drive-by-Download 攻撃予測のための難読化 JavaScript の検知に関する研究 Author(s) 本田, 仁 Citation Issue Date Type Thesis or Dissertation Text version author URL Rights Description Supervisor: 面和成, 情報科学研究科, 修士 Japan Advanced Institute of Science and

2 Drive-by-Download JavaScript

3 Drive-by-Download (DbD ) DbD web web DbD JavaScript DbD JavaScript JavaScript JavaScript Support Vector Machine JavaScript JavaScript JavaScript 3 D3M dataset bigram

4 Drive-by-Download JavaScript D3M dataset K K-Fold Cross Validation Support Vector Machine (SVM) Naive Bayes k-nearest Neighbor Decision Tree Random Forest Python[10] scikit-learn[11] HTMLParser[4] unigram, bigram XZZ 13[12] JCB 14[7] LJJ 09[8] CCVK 11[3] NHKEIN 14[9] i

5 AO 15[1] [9] [9] [9] JavaScript SVM JavaScript JavaScript JavaScript JavaScript SVM bigram bigram ii

6 1 1.1 Drive-by- Download (DbD ) DbD web web Bot IBM % 11.3% DbD [5] IPA [6] DbD DbD DbD web JavaScript JavaScript JavaScript DbD 1.2 DbD JavaScript DbD 2 JavaScript [9] JavaScript JavaScript JavaScript Support Vector Machine 1

7 JavaScript JavaScript 3 D3M dataset [9] bigram DbD 4 [9] 5 6 bigram 7 2

8 2 2.1 Drive-by-Download Drive-by-Download (DbD ) web web DbD DbD web DbD web JavaScript 2.2 JavaScript DbD JavaScript JavaScript JavaScript unescape() String.replace() String.charAt() eval() 2.2 JavaScript JavaScript unescape() eval() 3

9 2.1: DbD 2.3 D3M dataset 2.2: JavaScript D3M dataset MWS MWS datasets DbD D3M dataset DbD 3 1. URL DbD pcap pcap 4

10 2.3: K K-Fold Cross Validation K K K 1 K-1 K 1 K (K=5) 2.5 5

11 2.4: Support Vector Machine Support Vector Machine (SVM) SVM ( 2.4) SVM Naive Bayes Naive Bayes Naive Bayes Gaussian Naive Bayes Bernoulli Naive Bayes Multinomial Naive Bayes Gaussian Naive Bayes 6

12 2.5.3 k-nearest Neighbor 2.5: k-nearest Neighbor k-nearest Neighbor k 2.5 k=3 Class2 k=5 Class1 k=7 Class Decision Tree C4.5 CART C4.5 CART Random Forest Decision Tree 1 7

13 Python[10] Python Python scikit-learn[11] scikit-learn Python SVM Decision Tree Random Forest k-nearest Neighbor Naive Baise 2 scikit-learn HTMLParser[4] HTMLParser Python HTML HTMLParser HTMLParser HTML JavaScript HTMLParser 8

14 2.7 JavaScript 4 True Positive (TP) True Negative (TN) False Positive (FP) False Negative (FN) 4 Accuracy Accuracy T P + T N Accuracy = (2.1) T P + T N + F P + F N Precision Precision ( ) T P P recision = (2.2) T P + F P Recall Recall ( ) T P Recall = (2.3) T P + F N False Negative Rate (FNR) FNR ( ) 9

15 F NR = F N T P + F N (2.4) Recall (2.3) F NR = 1 Recall Recall FNR False Positive Rate (FPR) FPR ( ) F P R = F P T N + F P (2.5) (2.1) (2.2) (2.3) (2.4) (2.5) T P, T N, F P, F N Accuracy Precision FNR FPR 2.8 unigram, bigram unigram 1 unigram 1 1 bigram 2 bigram 2 1 N 1 N-gram N-gram N N-gram N 1 m N-gram m N 10

16 3 3.1 DbD ( ) XZZ 13[12] [12] JavaScript 11

17 3 1. unescape() 2. JavaScript 3. JavaScript unescape() eval () JCB 14[7] [7] JavaScript JavaScript N-gram Support Vector Machine web JavaScript JavaScript N-gram N N 12

18 4. N-gram σ σ N 5. SVM LJJ 09[8] [8] JavaScript JavaScript JavaScript eval CCVK 11[3] [3] FNR [3] 3 DbD 1. HTML iframe HTML HTML URL JavaScript eval() settimeout() setinterval() URL URL URL IP DNS A DNS NS FPR FNR 13

19 3.1: [7] 14

20 Feature 3.1: [8] Description Length in characters The length of the script in characters. Avg. characters per line The average number of characters on each line. Num. of lines The number of newline characters in the script. Num. of strings The number of strings in the script. Num. of unicode symbols The number of unicode characters in the script. hex or octal numbers A count of the numbers represented in hex or octal. % human readable We judge a word to be readable if it is > 70% alphabetical, has 20% < vowels < 60%, is less than 15 characters long, and does not contain > 2 repetitions of the same character in a row. % whitespace The percentage of the script that is whitespace. Num. of methods called The number of methods invoked by the script. Avg. string length The average number of characters per string in the script. Avg. argument length The average length of the arguments to a method, in characters. Num. of comments The number of comments in the script. Avg. comments per line The number of comments over the total number of lines in the script. Num. of words The number of words in the script where words are delineated by whitespace and JavaScript symbols (for example, arithmetic operators). % word not in comments The percentage of words in the script that are not commented out. 15

21 3.2: [1] 16

22 3.3.3 NHKEIN 14[9] [9] JavaScript AO 15[1] [1] URL [7] JavaScript N-gram 2 DbD JavaScript [9] JavaScript [9] 3 17

23 / 3.2: LJJ 09[8] JavaScript CCVK 11[3] HTML JavaScript URL 3 NHKEIN 14[9] JavaScript XZZ 13[12] JCB 14[7] JavaScript N-gram JavaScript AO 15[1] JavaScript 18

24 4 [9] 4.1 [9] 2.2 JavaScript JavaScript JavaScript [9] JavaScript [9] JavaScript 94 ASCII ASCII 0x21 0x7e i JavaScript m i JavaScript N F (i) N = i m i (4.1) F (i) = m i N (4.2) F (i) 0 F (i) 1 F (i) Support Vector Machine SVM unigram [9] JavaScript UTF [9] [9] JavaScript 19

25 JavaScript JavaScript JavaScript [9] JavaScript JavaScript JavaScript JavaScript [9] JavaScript JavaScript JavaScript JavaScript JavaScript JavaScript Document Object Model (DOM) HTML HTML DOM JavaScript JavaScript JavaScript [9] JavaScript JavaScript JavaScript JavaScript Alexa[2] 500 <script> JavaScript <script> 20

26 4.1: [9] JavaScript 2013/11/ /2/8-2013/2/ src URL URL JavaScript 4.2 JavaScript 1KB JavaScript [9] JavaScript JavaScript JavaScript D3M dataset [9] JavaScript jquery JavaScript JavaScript 1KB [9] JavaScript JavaScript SVM SVM [9] SVM libsvm SVM F (i) 94 SVM 94 JavaScript JavaScript JavaScript +1 JavaScript 1 21

27 4.2: [9] Result Accuracy 98.84% Precision 97.72% Recall 94.35% 2. SVM SVM RBF SVM C γ [9] libsvm grid.py [9] C = γ = Accuracy [9] MWS MWS datasets D3M dataset 3 1 SVM 1 SVM 2 [9] 22

28 [9] [9] JavaScript JavaScript [9] JavaScript JavaScript JavaScript JavaScript Alexa Top500[2] web URL <script> JavaScript <script> src URL JavaScript JavaScript Python JavaScript URL JavaScript Python 5.2 [9] 1KB JavaScript D3M dataset JavaScript JavaScript 1KB 23

29 5.1: 5.1: JavaScript 2015/6/9 2011/2/ /4/ JavaScript JavaScript JavaScript JavaScript JavaScript [9] Support Vector Machine (SVM) Naive Bayes (NB) k-nearest Neighbor (knn) Decision Tree (DT) Random Forest (RF) 5 knn k

30 5.2: JavaScript [9] JavaScript SVM SVM [9] RBF C γ 2 25

31 5.2: ( ) Accuracy Precision FNR FPR NB SVM (C = 329.9, γ = 61.7) DT RF k= k= knn k= k= k= : Accuracy Precision FNR FPR NB SVM (C = 501.0, γ = 5.92) DT RF k= k= knn k= k= k= FNR FNR FNR

32 FNR DT RF SVM Accuracy RF SVM DT SVM RF RF SVM Accuracy DT 3 knn FNR NB FNR Accuracy ( 5.3) FNR RF knn 0.8 (80%) FNR DT FNR SVM FNR Naive Bayes FNR % Accuracy Naive Bayes Naive Bayes FNR FPR 3.6% Naive Bayes [9] SVM 4.4 SVM SVM SVM 27

33 6 bigram 6.1 bigram bigram SVM 5.3 bigram 94 2 = unigram 5.3 NB SVM RF FNR knn FNR k 0.69 (69%) DT FNR 1767 FNR NB NB unigram 5.3 NB SVM RF FNR knn FNR k 0.72 (72%) 1767 DT FNR 4418 FNR NB NB bigram JavaScript 28

34 6.1: bigram (1767 ) Accuracy Precision FNR FPR NB SVM (C = 60.0, γ = 5.0) DT RF k= k= knn k= k= k= : bigram (4418 ) Accuracy Precision FNR FPR NB SVM (C = 216, γ = 2.3) DT RF k= k= knn k= k= k= NB RF FNR 94 2 =

35 7 DbD JavaScript [9] [9] D3M dataset SVM Naive Bayes Naive Bayes bigram Naive Bayes 74% 30

36 8,, Drive-by-Download JavaScript, The 33rd Symposium on Cryptography and Information Security (SCIS 2016),

37 32

38 [1] Takashi Adachi and Kazumasa Omote, An Approach to Predict Drive-by-Download Attacks by Vulnerability Evaluation and Opcode, The 10th Asia Joint Conference on Information Security (AsiaJCIS 2015), [2] Alexa Top 500 Global Sites, [3] Davide Canali, Marco Cova, Giovanni Vigna, Christopher Kruegel, Prophiler: a fast filter for the large-scale detection of malicious web pages, The 20th international conference on World wide web, [4] HTMLParser, [5] IBM, 2014 Tokyo SOC, www-935.ibm.com/services/jp/ja/it-services/soc-report/ [6], , [7] G.K. Jayasinghe, J.S. Culpepper, P. Bertok, Efficient and effective realtime prediction of drive-by download attacks, Journal of Network and Computer Applications Volume 38, February [8] P. Likarish, E. Jung, I. Jo Obfuscated malicious javascript detection using classification techniques, MALWARE 09, [9],,,,,, JavaScript, 2014-CSEC-64, vol.21, pp. 1-7, [10] Python, [11] scikit-learn, [12] W. Xu, F. Zhang, S. Zhu, Jstill: Mostly static detection of obfuscated malicious javascript code, CODASPY 13,

29 jjencode JavaScript

29 jjencode JavaScript Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of 2018-03 issue URL http://hdl.handle.net/10173/1975 Rights Text version author Kochi, JAPAN http://kutarr.lib.kochi-tech.ac.jp/dspa