Weaknesses in defenses against web-borne malware

摘要: Web-based mechanisms, often mediated by malicious JavaScript code, play an important role in malware delivery today, making defenses against web-borne crucial for system security. This paper explores weaknesses existing approaches to the detection of code. These generally fall into two categories: lightweight techniques focusing on syntactic features such as string obfuscation and dynamic code generation; heavier-weight that look deeper semantic characteristics presence shellcode-like strings or execution exploit We show each these has its weaknesses, state-of-the-art detectors using can be defeated cloaking combine emulation with anti-analysis checks. Our goal is promote a discussion research community robust defensive rather than ad-hoc solutions.