# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
We decided to implement the BIRCH algorithm [54] because it is simple yet produces a good cluster on the dataset. We set five cluster groups to quickly identify each group's characteristics that perhaps correlate with the performance in predicting malicious webpages. ## 5 Evaluation

In this section, we present the performance of the proposed method for detecting malicious webpages with a new approach based on AST-JS information. We describe its overall performance, analyze the manual features' influences, and provide an analysis of webpage features and AST-JS structures that correlate with webpage types based on clustering results. ### Overall Performance

We tested our proposed approach with several conditions based on the parameter settings and the inclusion of the AST-JS feature. Table 4 shows the accuracy performance for each condition with the best combination of feature categories. We experimented with new settings based on Table 4 and compared them with the original settings from previous work [44]. We also experimented with the inclusion of AST-JS to compare the performance before and after adding the proposed feature. We had to find the best combination of feature categories for every condition to get the optimum result. The experiments showed that our new settings give better results: around 84.75% accuracy, higher by 1.08% than the original setup. We can achieve those results by using the combination of feature categories L, H, C, and UL, which is fewer features than in the combination used in the original setup. Moreover, when adding AST-JS as our proposed feature, we can get a better result of around 84.84% accuracy with the best combination of feature categories of L, H, C, UL, IM, CE, UB, and AST-JS. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Setup**} & \multicolumn{2}{c}{**Without AST-JS**} & \multicolumn{2}{c}{**With AST-JS**} \\ \cline{2-4}  & **Best Feat. Cat. Comb.** & **Accuracy (\%)** & **Best Feat. Cat. Comb.** & **Accuracy (\%)** \\ \hline Original & L+H+C+UL+IM+CE+UB & 83.67 & L+C+UL+IM+UB+AST & 83.74 \\ New & L+H+C+UL & 84.75 & L+H+C+UL+IM+CE+UB+AST & 84.84 \\ \hline \hline \end{tabular}

* L = lexical; H = host-based; C = content; UL = URL embedding with Longformer; IM = image embedding; CE = content embedding; UB = URL embedding with BERT.

\end{table} 
Table 4: Overall performance of proposed method with and without AST-JS. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter Name** & **Original Setup** & **New Setup** \\ \hline Learning rate & 0.3 & 0.01 \\ Subsample & 0.8 & 0.5 \\ Evaluation metric & Logloss & Logloss \\ Gamma & 0.01 & 0.01 \\ Booster & Dart & Gbtree \\ Min. child weight & 1 & 1 \\ Max. depth & 10 & 6 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Parameter setup for the XGBoost model. AST-JS enriches webpage features that better represent the characteristics of JS code that probably contains the payload that attackers try to inject into the webpage. To test our hypothesis, we divided the dataset into two groups: webpages without JS and webpages with JS. This treatment can strengthen the performance because the model will focus more on learning these features, so it is not distracted with webpages without JS. Table 5 shows the experimental results. We achieved higher performance, around 86.10% accuracy, when all learning data contained JS information. Compared to webpages without JS coding, we obtained lower performance, around 81.63% accuracy, with our new model settings. Both the original and new settings can achieve better performance when we have JS information as a webpage feature. This is because the model should generalize and consider the webpage without JS, influencing the precision for obtaining more true positives. Table 6 shows the performance with different machine learning models. Not all webpages have JS information. Attackers could use WebAssembly to install malware if the browser \"sandbox\" holds up, or they could perform other attacks [55].