# Detection of Obfuscated Malicious JavaScript Code
## 3 Feature Extraction
\begin{table}
\begin{tabular}{c c c} \hline
**ID** & **Feature** & **Description** \\ \hline
29–39 & \# of occurrence of built-in functions & The number of occurrence of each built-in function: \\  & & eval, setTimeout, setInterval, unescape, replace, \\  & & document.write, charAt, substring, \\  & & String-fromCharCode, String\_charCodeAt, \\  & & navigator.userAgent \\ \hline
40–50 & Ratio of \# of occurrence of a built-in function to the script & The proportion of the total length of the script that is comprised of instances of a built-in function. \\ \hline
51–110 & \# of occurrence of keywords & The number of occurrences of each JavaScript keyword, totally 60 keywords \\ \hline
111–170 & Ratio of \# of occurrence of a keyword to the script length & The amount of times a keyword appears in relation to the total number of words in a screenplay. \\ \hline \multicolumn{3}{l}{* defined as datatype.} \\ \hline
**ID** & **Descriptions** & **r** & **|r**| & **p-value** \\ \hline
27 \% of backslash chars & 0.3446719 & 0.3446719 & 7E-123 \\ \hline
36 \# of occurrences of fromCharCode & 0.2981514 & 0.2981514 & 5.726-91 \\
47 \# ratio of num of occurrences of fromCharCode to script length & 0.2865197 & 0.2865197 & 7.442-84 \\
33 \# of occurrences of eval & 0.2424366 & 0.2442366 & 9.847E-61 \\
26 \% of encoded chars & 0.2103943 & 0.2103943 & 3.517E-45 \\
40 \# ratio of num of occurrences of charAt to script length & 0.1987196 & 0.1987196 & 2.129E-40 \\
14 \# maximum string length & 0.1752279 & 0.1752279 & 1.177E-31 \\
29 \# of occurrences of charAt & 0.173474 & 0.173474 & 4.756E-31 \\
37 \# of occurrences of unescape & 0.1366667 & 0.1366667 & 8.827E-20 \\
44 \# ratio of num of occurrences of eval to script length & 0.1366466 & 0.1366466 & 8.937E-20 \\
5 \% of string chars & 0.1224823 & 0.1224823 & 3.634E-16 \\
78 \# of occurrences of while & 0.1189251 & 0.1189251 & 2.538E-15 \\
119 \# ratio of num of occurrences of finally to script length & 0.1026508 & 0.1026608 & 8.884E-12 \\
138 \# ratio of num of occurrences of while to script length & 0.0988079 & 0.0988079 & 5.163E-11 \\
13 \# avg. string length & 0.0953272 & 0.0953272 & 2.393E-10 \\
39 \# of occurrences of write & 0.0782793 & 0.0782793 & 2.023E-07 \\
49 \# ratio of num of occurrences of charCodeAt to script length & 0.0731488 & 0.0731488 & 1.2E-06 \\
12 \# avg. string entropy & 0.0667411 & 0.0667411 & 9.455E-06 \\
23 \% of chars belonging to a function body & -0.064112 & 0.0641116 & 2.096E-05 \\
24 \# ratio of \# of functions to the script length & -0.062146 & 0.0621463 & 3.728E-05 \\
123 \# ratio of num of occurrences of function to script length & -0.062146 & 0.0621463 & 3.728E-05 \\
6 \% of whitespace & -0.061151 & 0.0611513 & 4.958E-05 \\
38 \# of occurences of charCodeAt & 0.0452145 & 0.0452145 & 0.00271 \\
59 \# of occurences of finally & 0.0435868 & 0.0435868 & 0.0038428 \\
1 \# script length & 0.042479 & 0.042479 & 0.0048437 \\
16 \# of “frame” strings & 0.0404414 & 0.0404414 & 0.0073183 \\
20 \# any num of arguments per function & 0.0291864 & 0.0291864 & 0.0529643 \\
21 \# avg. argument length & 0.0288318 & 0.0283818 & 0.055916 \\
4 \# avg chars per line & 0.0284708 & 0.0284708 & 0.0590603 \\
19 \# of long variables or function names & 0.0281235 & 0.0281235 & 0.0622224 \\
85 \# of occurences of do & 0.0271831 & 0.0271831 & 0.0714934 \\
121 \# ratio of num of occurences of var to script length & -0.026879 & 0.0268788 & 0.0747255 \\ \end{tabular}
\end{table} 
Table 1: _Cont._  
Figure 2: Correlation coefficients of different features. They are in decreasing order.