# Understanding the Influence of AST-JS for Improving Malicious Webpage Detection
## 3 Overview of Malicious Webpage Detection
### Ast-Js
Even though JS is widely used for malware infection, attackers can run any vulnerable extension. Further, if the browser uses outdated libraries, then a carefully crafted element can lead to code execution even without JS. ### Influences of Feature Categories

We determined the absolute mean SHAP value for each feature category, representing the influence on prediction output. The aim was to determine how our proposed feature can help the performance improvement after adding it to the other features. However, due to the existence of JS in a webpage, AST-JS features only help process a webpage with JS information, so we tried to calculate the SHAP values for two datasets: the full dataset and webpages with JS. Figure 6 reports the absolute mean SHAP values for two datasets, showing that AST-JS contributes much to the prediction output. It can be observed that the proposed feature, AST-JS, has a clear influence on producing the predicted labels. AST-JS is one of the top three feature categories in the whole dataset that mixes webpages with and without JS information. This result is understandable because in the whole dataset, we found that around 60% (60,939) of webpages do not have AST-JS features. This condition may influence how AST-JS contributes more to malicious code detection. This also reveals that URL information is a critical feature for achieving higher performance in malicious webpage prediction when we cannot find JS content. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Model** & **Precision** & **Recall** & **F-Score** \\ \hline Gaussian naive Bayes & 0.7134 & 0.5893 & 0.5504 \\ Logistic regression & 0.7169 & 0.6806 & 0.6822 \\ Decision tree & 0.7304 & 0.7299 & 0.7301 \\ Random forest & 0.8189 & 0.8001 & 0.8055 \\ XGBost & 0.8539 & 0.8317 & 0.8382 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance results for different machine learning models. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Setup**} & \multicolumn{2}{c}{**Webpage without JS**} & \multicolumn{2}{c}{**Webpage with JS**} \\ \cline{2-5}  & **Best Feat. Cat. Comb.** & **Accuracy (\%)** & **Best Feat. Cat. Comb.** & **Accuracy (\%)** \\ \hline Original & L+H+C+IM+UB & 80.34 & L+H+C+UL+IM+UB+AST & 85.57 \\ New & L+C+UL+IM+CE+UB & 81.63 & L+H+C+UL+IM+UB+AST & 86.10 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Overall performance of the proposed method on webpages that contain JS and those that do not. Despite that, we still need to consider JS information, where most attackers apply their efforts. Furthermore, AST-JS successfully captures JS information via a low-dimensional representation that can enrich the features to identify a malicious webpage. In Figure 7, we also can see that when the model focuses on webpages with JS, the AST-JS feature has the most influence among all feature categories and can even have more influence than URL information. ### Comparison with Other JavaScript-Related Features

The original GAWAIN dataset [44] contains JS information that can be extracted as syntactical features. However, these features do not truly capture the whole semantic meaning of JS code, so the model fails to benefit from the existence of JS code. Even though it catches the code's most crucial information (e.g., the number of suspicious JS functions), those features are still insufficient due to some obfuscation techniques that may be applied to evade a detection system and security analyst. To ensure that our proposed approach to extracting the JS information is better than using other JS-related features, we calculated the SHAP values for all those features and compared them with AST-JS's embedding representation. The other features were excluded from this analysis to focus more on features extracted from JS code in a webpage and to make a fair comparison. Figure 8 shows the results. There are two summaries of SHAP values for two different datasets, a full dataset and a dataset where the webpages have JS information.