29 jjencode JavaScript

Size: px

Start display at page:

Download "29 jjencode JavaScript"

ひろじしばもと
7 years ago
Views:

Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of 2018-03

1 Kochi University of Technology Aca Title jjencode で難読化された JavaScript の検知 Author(s) 中村, 弘亮 Citation Date of issue URL Rights Text version author Kochi, JAPAN

2 29 jjencode JavaScript

3 jjencode JavaScript Web JavaScript Web JavaScript Web jjencode JavaScript jjencode i

4 Abstract Koryo NAKAMURA In recent years, a drive-by download attack of infecting malware by browsing a tampered legitimate website has been reported. Most of the malicious JavaScript used for attacks has been treated as obfuscated, but obfuscation may be applied to JavaScript on common Web sites as well. Obfuscation research that can be used for attacks in this way but can also be used on ordinary malicious Web sites is important. Among various obfuscation methods, there is a relatively new method of converting to a code with only symbols. However, there are still few studies targeting obfuscation method where obfuscated code becomes only symbols. Nishida s method, which is an existing research, is effective for this obfuscation method, but the method had a problem that verification of the feature acquired by machine learning was not sufficient. In this paper, we aimed to verify whether obfuscation can be detected if the code after obfuscation is only a symbol. In addition, we verify what can be distinguished by using the character appearance frequency. This experiment showed that it was possible to discriminate between code obfuscated by jjencode and general code, and it became clear that obfuscation can be learned by using the existing method. key words JavaScript obfuscation jjencode ii

5 JavaScript SVM iii

6 Web SVM iv

7 false f jjencode v

8 JavaScirpt vi

9 1 1.1 Web [1] JavaScript JavaScript Web Web jjencode [2] JavaScript [3] 1

10 JavaScript

11 2 JavaScript

12 Web Web HTML id

13 jjencode 2.1 JavaScript Obfuscator Tool[4] Hello World!

14 Unicode JavaScript JavaScript

15 false false 2.5 f jjencode [5] 2.3 JavaScript [6] JavaScript JavaScript 2.5 f 7

16 jjencode JavaScript scirpt JavaScript 8

17 3 JavaScript 3.1 JavaScript JavaScript JavaScript 3.2 MWS Dataset 2013[7] D3M Web Alexa[8] 500 Web JavaScript 9

18 3.3 1KB 3.3 ASCII 0x21 0x7e [A-Z] [a-z] 0x41-0x5a 0x61-0x7a [0-9] 0x30-0x39 0x21-0x2f 0x3a-0x40 0x5b-0x60 0x7b-0x7e i m i N F (i) (3.1) (3.2) N = n m i (3.1) i F (i) = m i N (3.2) F (i)

19 3.4 SVM 3.4 SVM SVM(Support Vector Machine) 2 [9] SVM 3.5 SVM RBF( ) C = = % (accuracy) 11

20 4 jjencode jjencode Web 2. jjencode SVM 12

21 Web Web Alexa Top 500 Global Sites Web Alexa 10 script JavaScript script JavaScript JavaScript Web JavaScript 4.1 JavaScirpt ,754,808 bites 33,687 bites 1,682,739 bites 23 bites 1KB JavaScript JavaScript jjencode 1KB Web jjencode MWS Dataset 2013 D3M 13

22 4.1 Web ASCII 0x21 0x7e jjencode 0x21 0x7e 14

23 e t a n (0x2e) (0x65) (0x74) (0x61) (0x6e) $ +. (0x24) (0x5f) (0x2b) (0x2e) (0x22) jjencode Web jjencode SVM SVM

24 RBF C = 1 = 1 100% 16

25 5 jjencode 100% jjencode 100% 1KB jjencode aaencode Web 17

26 Web Web Web Web 18

27 6 jjencode jjencode jjencode 19

28 20

29 [1] Information-technology Promotion Agency, Japan IPA, IPA, /01outline.html, [2] Yosuke HASEGAWA, JavaScript, hasegawayosuke/javascript , [3],,,,,, JavaScript, Vol.2014-CSEC-64, No.21, pp.1-7, [4] Tiago Serafim, JavaScript Obfuscator Tool, herokuapp.com/, [5] Yosuke HASEGAWA, jjencode - Encode any JavaScript program using only symbols, [6],,,, JavaScript, Vol.2014-DPS-161, No.17, pp.1-7, [7],,,,,, MWS Datasets 2013, Computer Security Symposium 2013, [8] Alexa Internet, Inc., Alexa Top 500 Global Sites, topsites, [9],,,

三税協力の実質化 : 住民税の所得税閲覧に関する国税連携の効果

三税協力の実質化 : 住民税の所得税閲覧に関する国税連携の効果 Kwansei Gakuin University Rep Title 三税協力の実質化 : 住民税の所得税閲覧に関する国税連携の効果 Author(s) Suzuki, Ushio, 鈴木, 潮 Citation 経済学論究, 65(4): 175-197 Issue Date 2012-03-20 URL http://hdl.handle.net/10236/9133