# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
Therefore, to solve this problem, we omit some nodes within the graph without removing the semantic meaning of either the structure or node attributes. Thus, omitting some nodes can give some advantages to our detection system. The first advantage is that it can reduce the time spent processing the input data because it does not need to visit (examine) all nodes within the graph, which can have more than 100,000 nodes. In addition, node omission can reduce the memory used to train all parameters in our model. We cannot ignore that memory capacity limits training, especially if we want to train with a large dataset. The final advantage is that it prevents our model from overfitting due to too many parameters, which would happen if we consider an AST graph with a relatively large number of nodes. [PERSON] et al. [50] proved that the lightweight AST, which reduces the number of nodes in the AST graph, can have higher accuracy and time efficiency than the conventional AST. Furthermore, we cannot reduce the number of AST graph nodes randomly. We need to choose nodes that are \"safe\" to remove without compromising our purpose. We use a breadth-first search (BFS) tree algorithm to select nodes for removal. BFS refers to the method in which we traverse a graph by examining all children of a node before moving on to that child's children Figure 5. The BFS algorithm visits all graph nodes that traverse the graph layerwise, thereby exploring the neighboring nodes. As we can see, BFS provides a layerwise algorithm that fits our problem. The AST graph has a top-down structure in which the parent nodes sufficiently represent the child nodes under the parents. We can consider the bottom node as the top node's detailed information, described by the node type. ### Representation Learning

In this study, we used graph2 vec [11] for representation learning to obtain a low-dimensional vector. After we had a set of graphs \(\mathbb{G}=\{G_{1},G_{2},\ldots,G_{N}\}\), which was the result of AST-JS transformation, we used graph2 vec to encode each graph to closely represent the AST graph's characteristics. This unsupervised learning process produced a vocabulary embedding vector to store all AST-JS representations for building a malicious webpage detection model. For a more detailed explanation, let \(G=(N,E,f)\), where \(N\) is a set of nodes, \(E\) is a set of edges, and \(f\) is a function for mapping each node with a label \(l\). Then, a rooted subgraph can be written as \(sg=(N_{sg},E_{sg},f_{sg})\). In a graph \(G_{i}\), a rooted subgraph of degree \(D\) around node \(n\in N\) contains all the nodes reachable in \(d\) hops from \(n\). We identify all the neighbors of \(n\in N\) using the BFS algorithm where \(d>0\). Using all rooted subgraphs, we can train an unsupervised model such as doc2 vec [51], where a set of AST graphs \(\mathbb{G}=\{G_{1},G_{2},\ldots,G_{N}\}\) and a sequence of rooted subgraphs \(SG=\{sg_{1},sg_{2},\ldots,sg_{N}\}\) are sampled from AST graph \(G_{i}\in\mathbb{G}\). The graph2 vec skip-gram learns \(F\)-dimensional embeddings of the graph \(G_{i}\in\mathbb{G}\), and each rooted subgraph \(sg_{i}\) sampled from \(SG\). This model considers a rooted subgraph \(sg_{i}\in SG\) to be occurring in the context of graph \(G_{i}\) and maximizes the following log-likelihood:

\[\sum_{j=1}logPr(sg_{j}|G_{i}) \tag{1}\]

where the probability of \(Pr(sg_{j}|G)\) is defined as

\[\frac{exp(G\cdot sg_{j})}{\sum_{sg\in\mathbf{V}}exp(G\cdot sg)}, \tag{2}\]

where \(\mathbf{V}\) is the vocabulary of all the rooted subgraph across all graphs in \(G\). Figure 5: Using the BFS algorithm to trim the AST graph to obtain the minimum number of nodes needed for machine learning. ### SHAP Values

SHAP is a unified framework for interpreting predictions by assigning an importance value for each feature that influences a particular prediction [43]. This method addresses one of the concerns in machine learning, namely, interpretability, where researchers try to explain how their model makes predictions.