JSObfusDetector: A binary PSO-based one-class classifier ensemble to detect obfuscated JavaScript code

摘要: JavaScript code obfuscation has become a major technique used by malware writers to evade static analysis techniques. Over the past years, number of dynamic techniques have been proposed detect obfuscated malicious at runtime. However, because their runtime overheads, these are slow and thus not widely in practice. On other hand, since large quantity benign is protect intellectual property, it effective use intrinsic features for purposes. Therefore, we forced distinguish between non-obfuscated so that can devise an efficient code. In this paper, address issue presenting JSObfusDetector, novel one-class classifier ensemble To construct ensemble, apply binary particle swarm optimization (PSO) algorithm, called ParticlePruner, on initial SVM classifiers find sub-ensemble whose members both accurate diversity outputs. We evaluate JSObfusDetector using dataset The experimental results show achieve about 97% precision, 91 % recall, 94% F-measure.