A simple client-side defense against environment-dependent web-based malware

摘要: Web-based malware tend to be environment-dependent, which poses a significant challenge on defending web-based attacks, because the malicious code - may exposed and activated only under specific environmental conditions such as version of browser not triggered during analysis. This paper proposes simple approach for environment-dependent malware. Instead increasing analysis coverage in detector, goal this technique is ensure that client will take same execution path one examined by detector. designed work alongside it can handle cases existing multi-path exploration techniques are incapable of, provides an efficient way identify discrepancies JavaScript program's behavior user's environment compared its sandboxed thereby detecting false negatives have been caused dependencies. Experiment shows effectively detect discrepancy various forms, including those seen real