Artifacts for the ISSTA 2023 Paper: An Empirical Study on the Effects of Obfuscation on Static Machine Learning-based Malicious JavaScript Detectors

An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors This repository contains the evaluation script and the corresponding data of the ISSTA'23 paper "An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors". Abstract Machine learning is increasingly being applied to malicious JavaScript detection in response to the growing number of Web attacks and the attendant costly manual identification. In practice, to hide their malicious behaviors or protect intellectual copyrights, both malicious and benign scripts tend to obfuscate their own code before uploading. While obfuscation is beneficial, it also introduces some additional code features (e.g., dead code) into the code. When machine learning is employed to learn a malicious JavaScript detector, these additional features can affect the model to make it less effective. However, there is still a lack of clear understanding of how robust existing machine learning-based detectors are on different obfuscators. In this paper, we conduct the first empirical study to figure out how obfuscation affects machine learning detectors based on static features. Through the results, we observe several findings: 1) Obfuscation has a significant impact on the effectiveness of detectors, causing an increase both in false negative rate (FNR) and false positive rate (FPR), and the bias of obfuscation in the training set induces detectors to detect obfuscation rather than malicious behaviors. 2) The common measures such as improving the quality of the training set by adding relevant obfuscated samples and leveraging state-of-the-art deep learning models can not work well. 3) The root cause of obfuscation effects on these detectors is that feature spaces they use can only reflect shallow differences in code, not about the nature of benign and malicious, which can be easily affected by the differences brought by obfuscation. 4) Obfuscation has a similar effect on realistic detectors in VirusTotal, indicatingthat this is a common real-world problem. Getting Started Requirements install python3 version 3.9.12 pip3 install -r requirements.txt install nodejs install npm npm install escodegen npm install esprima Step 1: Generating PDGs for JStap cd detectors/jstap/pdg_generation python generate_PDGs.py Step 2: Getting the results for RQ1: What Impact Does Obfuscation Have on Static Machine Learning Malicious JavaScript Detectors? cd RQ1/ 1. Detectors Performance on Obfuscated Samples. To train the models: python RQ1_1_train.py To get the results: python RQ1_1_test.py 2. Different Machine Learning Algorithms. To train the models: python RQ1_2_train.py To get the results: python RQ1_2_test.py 3. Biased Training Sets To train the models: python RQ1_3_train.py To get the results: python RQ1_3_test.py All the trained models will be stored in RQ1/models/. All the results will be stored in RQ2/results/. Step 3: Getting the results for RQ2: Are the Common Measures to Mitigate the Impact of Obfuscation Effective? cd RQ2/ 1. Training and Testing Detectors on Samples with Same Types of Obfuscation. To train the models: python RQ2_1_train.py To get the results: python RQ2_1_test.py 2. Training and Testing Detectors on Samples with Different Types of Obfuscation. If you follow the steps, the models is already trained. To get the results: python RQ2_2_test.py 3. BERT Variants. To get the results: python RQ2_3.py All the trained models will be stored in RQ2/models/. All the results will be stored in RQ2/results/. Step 4: Getting the results for RQ3: What Is the Root Cause of Obfuscation Affecting Static Machine Learning Malicious JavaScript Detectors? To get the results of vectors visualization, top ten features, and distances between vectors sets: cd RQ3 python visulization.py The figures of vectors visualization will be stored in RQ3/results/. Other results will be shown in the console. Step 5: Getting the results for RQ4: How Does Obfuscation Affect Real-world Static Malicious JavaScript Detectors? To get the results, submit the sample under the folder samples/ to VirusTotal . Detailed Instructions detectors The detectors under the folder detectors/ are the main projects to be evaluated in our paper, which are CUJO, ZOZZLE, JAST, and JSTAP. Detailed setup and usage instructions are described in README.md in the corresponding folder. samples The files under the folder samples/ are the samples from a random tenth of our dataset used in our paper. Results can be obtained quickly using these samples. These results will not be exactly the same as in the paper, but they are similar. RQ1 The code under folder RQ1/ is to figure out how obfuscation affects these detectors. RQ1_1_train.py is to train four detectors with unobfuscated samples. RQ1_1_test.py tests these trained detectors with unobfuscated and obfuscated samples. RQ1_2_train.py is to train the detector ZOZZLE that uses different machine learning algorithms. RQ1_2_test.py tests these trained models with unobfuscated and obfuscated samples. RQ1_3_train.py uses a training set with all unobfuscated benign samples and all obfuscated malicious samples, and a training set with all obfuscated benign samples and all unobfuscated malicious samples to train the detectors. RQ1_3_test.py uses these detectors to detect unobfuscated benign samples, obfuscated benign samples, unobfuscated malicious samples, and obfuscated malicious samples, respectively. RQ2 The code under folder RQ2/ is to study the two measures to mitigate the impact of obfuscation effective or not. RQ2_1_train.py uses obfuscated samples to train four detectors. RQ2_1_test.py tests these detectors on the same type of obfuscated samples. RQ2_2_test.py tests thest detectors on the different type of obfuscated samples. RQ2_3.py uses the BERT variants to generate code representation of unobfuscated samples, trains the detector with these code representations, and tests the trained detectors with code representations of obfuscated samples. RQ3 The code unser fodler RQ3/ visualizes the vectors, extracts the ten most important features, and calculates the distance between different sets of vectors. RQ4 There is no code related to RQ4 here because the actual operation of RQ4 is to submit the samples to VirusTotal . The whole dataset is available at https://drive.google.com/file/d/1a7pNUwzikiJyY9L7dIu53I6_MR0oDpgi/view?usp=sharing. Cite this work @inproceedings{staticanalysis, author = {Kunlun Ren, Qiang Weizhong, Yueming Wu, Yi Zhou, Deqing Zou, Hai Jin}, title = {An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors}, booktitle = {Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA'23)}, year = {2023} }《混淆对基于静态机器学习的恶意JavaScript检测器影响的实证研究》 本仓库收录了发表于ACM SIGSOFT第32届国际软件测试与分析大会（ISSTA'23）的同名论文的评估脚本与配套实验数据。 ### 摘要 随着Web攻击数量不断攀升，且人工识别恶意代码的成本居高不下，机器学习（Machine Learning）正日益广泛地应用于恶意JavaScript检测领域。实际场景中，无论是恶意脚本还是良性脚本，为隐藏自身恶意行为或保护知识产权，往往会在上传前对代码进行混淆（Obfuscation）处理。尽管代码混淆具备一定益处，但同时也会向代码中引入额外的代码特征（例如死代码（dead code））。当使用机器学习构建恶意JavaScript检测器时，这些额外特征会干扰模型，导致其检测性能下降。但目前学界仍未明确：现有基于机器学习的检测器，在面对不同混淆工具时的鲁棒性究竟如何。 本文开展了首个针对“混淆如何影响基于静态特征的机器学习检测器”的实证研究。通过实验结果，我们得到了四项核心发现：1）混淆对检测器的检测性能存在显著负面影响，会同时提升假阴性率（False Negative Rate, FNR）与假阳性率（False Positive Rate, FPR）；且训练集中的混淆偏向性，会使检测器倾向于识别混淆特征而非恶意行为本身。2）常见的缓解手段（例如通过添加相关混淆样本提升训练集质量、采用当前最优的深度学习模型）均无法有效解决该问题。3）混淆对这类检测器产生影响的根本原因在于：其使用的特征空间仅能反映代码的表层差异，而非区分良性与恶意代码的本质特征，因此极易受到混淆带来的差异干扰。4）混淆对病毒总（VirusTotal）中的现实商用检测器同样存在类似影响，这表明该问题是一个普遍存在的现实痛点。 ### 快速上手 #### 环境依赖 1. 安装Python 3.9.12版本 2. 执行`pip3 install -r requirements.txt`安装依赖包 3. 安装Node.js与npm包管理器 4. 执行`npm install escodegen`与`npm install esprima`安装所需npm依赖 #### 步骤1：为JStap生成程序依赖图（Program Dependence Graph, PDG） bash cd detectors/jstap/pdg_generation python generate_PDGs.py #### 步骤2：获取研究问题1（RQ1）的实验结果：混淆对基于静态机器学习的恶意JavaScript检测器存在何种影响？ bash cd RQ1/ 1. **混淆样本上的检测器性能** 训练模型： bash python RQ1_1_train.py 获取实验结果： bash python RQ1_1_test.py 2. **不同机器学习算法的对比** 训练模型： bash python RQ1_2_train.py 获取实验结果： bash python RQ1_2_test.py 3. **带有混淆偏向性的训练集** 训练模型： bash python RQ1_3_train.py 获取实验结果： bash python RQ1_3_test.py 所有训练好的模型将存储于`RQ1/models/`目录下，所有实验结果将存储于`RQ2/results/`目录下。 #### 步骤3：获取研究问题2（RQ2）的实验结果：常见的缓解混淆影响的手段是否有效？ bash cd RQ2/ 1. **使用相同类型混淆样本训练与测试检测器** 训练模型： bash python RQ2_1_train.py 获取实验结果： bash python RQ2_1_test.py 2. **使用不同类型混淆样本训练与测试检测器** 若按前述步骤操作，模型已完成训练。直接执行以下命令获取实验结果： bash python RQ2_2_test.py 3. **BERT变体（BERT Variants）** 执行以下命令获取实验结果： bash python RQ2_3.py 所有训练好的模型将存储于`RQ2/models/`目录下，所有实验结果将存储于`RQ2/results/`目录下。 #### 步骤4：获取研究问题3（RQ3）的实验结果：混淆影响静态机器学习恶意JavaScript检测器的根本原因是什么？ 执行以下命令获取向量可视化、前十重要特征以及向量集间距离的实验结果： bash cd RQ3 python visulization.py 向量可视化结果图将存储于`RQ3/results/`目录下，其余实验结果将直接在控制台输出。 #### 步骤5：获取研究问题4（RQ4）的实验结果：混淆如何影响现实场景中的静态恶意JavaScript检测器？ 将`samples/`目录下的样本提交至病毒总（VirusTotal）即可获取实验结果。 ### 详细说明 #### detectors目录 `detectors/`目录下收录了本文评估的四款主流检测器：CUJO、ZOZZLE、JAST与JSTAP。各检测器的详细部署与使用说明，请参见对应文件夹下的`README.md`文件。 #### samples目录 `samples/`目录下的样本取自本文实验数据集的随机十分之一子集，使用这些样本可快速获取实验结果。所得结果虽与论文中呈现的结果不完全一致，但趋势相近。 #### RQ1目录 `RQ1/`目录下的代码用于探究混淆对检测器的影响机制： - `RQ1_1_train.py`：使用未混淆样本训练四款检测器 - `RQ1_1_test.py`：使用未混淆与混淆样本测试已训练的检测器 - `RQ1_2_train.py`：针对ZOZZLE检测器，使用不同机器学习算法进行训练 - `RQ1_2_test.py`：使用未混淆与混淆样本测试上述基于不同算法训练的模型 - `RQ1_3_train.py`：使用两类带有混淆偏向性的训练集训练检测器：一类为“全未混淆良性样本 + 全混淆恶意样本”，另一类为“全混淆良性样本 + 全未混淆恶意样本” - `RQ1_3_test.py`：分别使用上述检测器检测未混淆良性样本、混淆良性样本、未混淆恶意样本与混淆恶意样本 #### RQ2目录 `RQ2/`目录下的代码用于验证两种常见缓解混淆影响的手段是否有效： - `RQ2_1_train.py`：使用混淆样本训练四款检测器 - `RQ2_1_test.py`：使用相同类型的混淆样本测试已训练的检测器 - `RQ2_2_test.py`：使用不同类型的混淆样本测试已训练的检测器 - `RQ2_3.py`：使用BERT变体生成未混淆样本的代码表征，基于这些表征训练检测器，并使用混淆样本的代码表征测试模型性能 #### RQ3目录 `RQ3/`目录下的代码用于实现向量可视化、提取前十项最重要的特征，以及计算不同向量集之间的距离。 #### RQ4目录 `RQ4/`目录下无相关代码，因为研究问题4的实验操作仅需将样本提交至病毒总（VirusTotal）即可完成。 ### 完整数据集获取 完整数据集可通过以下链接获取：https://drive.google.com/file/d/1a7pNUwzikiJyY9L7dIu53I6_MR0oDpgi/view?usp=sharing ### 引用格式 bibtex @inproceedings{staticanalysis, author = {Kunlun Ren, Qiang Weizhong, Yueming Wu, Yi Zhou, Deqing Zou, Hai Jin}, title = {An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors}, booktitle = {Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA'23)}, year = {2023} }