JSGuard: Shellcode Detection in JavaScript

摘要: JavaScript (JS) based shellcode injections are among the most dangerous attacks to computer systems. Existing approaches have various limitations in detecting such attacks. In this paper, we propose a new detection methodology that overcomes these by fully using JS code execution environment information. We leverage information and create virtual where shellcodes’ real behavior can be precisely monitored redundancy reduced. Following methodology, implement JSGuard, prototype malicious system Debian Linux with kernel version 2.6.26. Our extensive experiments show JSGuard reports very few false positives negatives acceptable overhead.