# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
These two datasets show how the existence of JS can affect the distribution of the influence of each feature for prediction. In Figure 9, we can see that in the top 20 feature influences, AST-JS representation dominates the list compared to other JS-related features. Nevertheless, JS length (\"is-length\") and the average length of JS code (\"js_array_length_avg\") still rank number one and two, respectively, for SHAP value distribution. Figure 6: Average SHAP value for each feature category. Figure 7: Average SHAP value for each feature category with a dataset that has JavaScript content. ### AST Feature Influence

In this experiment, we evaluated the influence of each feature category on a particular group of webpages that probably have a different contribution distributions for detecting malicious webpages. This analysis consisted of two main steps: clustering and feature importance analysis. The clustering step aimed to obtain some group clusters with similar features in the vector space to analyze the influence of feature categories based on SHAP values. Another consideration for clustering instead of webpage type labeling is that we need the ground truth, which is challenging. In addition, many webpages in the dataset are offline, which makes it hard to access them and identify their type. Table 7 shows the clustering results using the BIRCH algorithm [54]. Clusters 0 and 2 have many similar webpages compared to clusters 1, 3, and 4. We also identified each cluster based on the percentage of unique hostnames per total number of URLs in each cluster. In Table 8, we can see how attackers try to attack the target with a single webpage or inject the payload into some webpages with the same hostname. The high percentage in cluster 2 indicates that most webpages are single webpages, where attackers probably create the webpages randomly without making a complex website. Figure 8: Two summaries of SHAP values: **(a)** full dataset; **(b)** dataset containing only JavaScript code. Figure 9: Top 20 features based on SHAP values: **(a)** full dataset; **(b)** dataset containing JavaScript code. For the following analysis, we evaluated the influences of all feature categories to determine whether they are beneficial for building a detection model. In Figure 10, we show a summary of the total average SHAP value for each feature category. As we can see in the graph for cluster 2, even though the AST has the most significant influence, URL information still has a strong influence because we can find many single webpages that tend to have a randomized or unique URL name. We did not analyze clusters 3 and 4 due to a lack of data. ## 6 Conclusions

This study involved the development of a new approach for improving malicious webpage detection based on analyzing the AST structure of JS coding. This addition supports a deeper analysis of the semantic meaning of JS code, whereas the previous work [44] did not include that feature for building the model. Our evaluation shows that adding an AST-JS feature representation can improve the performance of the detection model, especially for webpages with JS content. Furthermore, our evaluation shows the significant influence of AST-JS on the detection model to detect either benign or malicious webpages, and it also is dominant compared to other JS-related features. We found that the AST-JS and URL features share a strong influence on some webpages that tend to be single websites that may have randomized URLs. However, our proposed approach only works well on webpages with JS content, which is the limitation of this study. Many malicious webpages without JS content probably \begin{table}
\begin{tabular}{c c c} \hline \hline
**Cluster** & **Benign** & **Malicious** \\ \hline
0 & 1568 & 712 \\
1 & 123 & 33 \\
2 & 21,879 & 10,857 \\
3 & 12 & 3 \\
4 & 2 & 0 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Clustering results. Figure 10: Total average SHAP values for (**a**) cluster 0, (**b**) cluster 1, and (**c**) cluster 2.