# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
* URL embedding with BERT (UB): We use the Distilbert transformer [48] to transform URL text into a low-dimensional representation. The reason for improving on the work of [PERSON] et al. [44] is that their work covers all kinds of features of a webpage, from the URL to the JS code. They also proposed a good dataset that is quite challenging for building a model to separate malicious and benign webpages. However, their work did not sufficiently explore a webpage's JS content, which is the critical point of maliciousness code. Most web security threats, such as drive-by download, XSS, or injection, use JS as the payload for their attack. Therefore, we need an additional extraction for JS content to improve detection performance, especially for specific threats related to JS. #### 3.4.3 AST Parsing

We start with the JS code file in Listing 1. We can then parse each statement from top to bottom to break it into smaller source code components. We have to check the syntactic category to which the code belongs. For example, in Listing 1, the first code line is a \"VariableDeclaration\" object consisting of one \"VariableDeclarator\" object. This object has two main properties: \"BinaryExpression\" and \"Identifier\". For binary expression, we will have two literal values, 6 and 7, as the property of that object. Figure 4 depicts how we can parse one line of JS code into an AST. There are many tools for representing JS code files as ASTs. We used the popular open-source AST-JS parser Esprima [49]. This tool performs lexical and syntactical analysis of JS programs running in some JS environments, including web browsers (including Edge, Firefox, Chrome, and Safari), node.js, and a JS engine in Java (e.g., Rhino). The Esprima parser takes a string representing an accurate JS program and generates a syntax tree, an ordered tree that defines its syntactic structure. Esprima acquires the syntax tree format originating from the Mozilla Parser API, formalized and expanded as the ESTree specification. #### 3.4.4 AST Graph Construction and Node Reduction

The Esprima parser transforms JS code into an AST representation. However, in the JSON format, its elements are a list of syntactic unit objects with some properties depending on the type of syntactic unit, such as an \"AssignmentPattern\" with three properties: type, left, and right. Nevertheless, every object always has a type property that indicates the name of the syntactic type. Thus, we have to generate graph objects that describe the structure and attributes of the AST representation. Let \(\mathcal{S}=\{S_{0},S_{1},S_{2},\ldots S_{N}\}\) be a set of AST files that we want to use to generate the graph object. Each of them has a list of the syntactic unit types that construct the AST object. As the number of units is finite, we can create the syntactic units' vocabulary \(T\) as the node type. We use a recursion algorithm to generate all nodes of the AST. The detailed recursive

Figure 4: How we break down a single JavaScript statement into an AST. algorithm is presented as Algorithm 1. We assign the parent input as the \"root\" node for the starting node. ```
input :AST object \(S_{i}\), parentNode, a graph \(\mathcal{G}\) output :\(\mathcal{G}\) Function Recursive-Generator\((S_{i},parentNode,\mathcal{G})\) is \(nodeName=S_{i}[type]\); \(\mathcal{G}.\mathcal{V}.add(nodeName)\); \(\mathcal{G}.\mathcal{E}.add(parentNode,nodeName)\); if\(S_{i}\) has an object then for\(s\) in \(S_{i}\)do  Recursive-Generator\((s,nodeName,\mathcal{G})\)  end if  end for  end for
```

**Algorithm 1**Generating a graph from an AST. Reducing the number of nodes in an AST graph is necessary because a large number of nodes within a graph increases the burden of the graph representation learning model when obtaining its optimal value. It will take much time to visit all nodes within the graph, making detection inefficient. If we consider all possible nodes, the memory consumption will exceed the capacity of typical computing systems.