HideNoSeek: Camouflaging Malicious JavaScript ...
summary
HideNoSeek automatically rewrites malicious JavaScript ASTs into exact copies of benign ASTs (using an AST enhanced with control and data-flow) so the rewritten scripts keep malicious behavior while matching benign ASTs. The implementation uses 23 seeds to generate 91,020 samples that reproduce ASTs from Alexa Top 10k; trained static classifiers record 99.98% false negatives on these inputs, and training on them produces >88% false positives, breaking lexical/syntactic detectors.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:29JavaScript
- 0:58Motivation
- 3:11Contributions
- 3:53Methodology
- 4:55Abstract Code Representation: AST
- 7:51Clone Detection - Code Level
- 9:14Clone Detection - AST++ Level
- 11:29Clone Selection
- 12:23Clone Replacement
- 13:47Benign Adjustments
- 16:03Code Generation With Escodegen
- 16:38Experimental Setup
- 19:22Impact of our Attack
- 21:03Run-Time Performance
- 22:14Properties of the Crafted Samples
- 30:03Potential Detection Strategies
- 32:10Evaluation Against Real-World Classifiers
- 34:33Conclusion: HIDENOSEEK
related talks
31mFinding Stealthy Bots in Javascript Hide and Seek
47mJavaScript Obfuscation: It’s All About the P a c k e r s
23mNext-Generation of Exploit Kit Detection By Building Simulated Obfuscators
52mBreaking Fraud and Bot Detection Solutions
42mFinding Bad Needles On A Worldwide Scale
40mHostile JavaScript: Attacking and Defending the Browser
16mHarnessing AI for Malevolence: A Hackers Tale
44mHeadless Browser Hide and Seek