# Detecting Web-Based Attacks with SHAP and Tree Ensemble Machine Learning Methods
## 3 Proposed Method
### Preprocessing
#### 3.1.2 Sample JS Attack Codes  
Malicious JS code rarely uses raw values, as attackers endeavor to evade static analyzers. Therefore, it is essential to capture features that employ covert implementations to hide their values. To capture these features, we analyzed the feature importance of our first feature set using SHAP interaction values. This feature analysis exposed each AST-JS node and the combination's contribution to the malicious JS code detection model. To identify such combinations, we obtained sample JS attack codes and performed association rule mining using the Frequent Pattern growth (FP-growth) mlxtend library [41; 42; 43]. The sample JS attack codes are explained next. Listing 1 shows a JS code that lacks a definition of the index of an object in the current scope. When \(foo()\) is called, \(x=0\) is passed, which is a local index of the function. We capture this attack pattern using the AST node \(type\)\(EmptyStatement\_ExpressionStatement\_CallExpression\_Identifier\). Listing 2 shows a JS code where the argument of \(setTimeout()\) is a string concatenation with binary expression. We capture this attack pattern using the AST node \(type\)\(CallExpression\_Identifier\_BinaryExpression\). Figure 1: The proposed web-based attacks detection method. ```
1 functionfoo(x){
2 vararr=[\"1\",\"2\",\"3\"];
3 eval(arr[x])
4};
5 foo(0);
6//ASTforEmptyStatement\ExpressionStatement\_CallExpression\_Identifier
7\"type\":\"EmptyStatement\"
8},
9{
10\"type\":\"ExpressionStatement\",
11\"expression\":{
12\"type\":\"CallExpression\",
13\"callee\":{
14\"type\":\"Identifier\",
15\"name\":\"foo\"
16},
17\"arguments\":[
18{
19\"type\":\"Literal\",
```  
Listing 1: A snippet of a JS code with EmptyStatement_Expression_Identifier. ```
1 functionstartOverflow(num){
2}
3 if(num==255)setTimeout(\"startOverflow(\"+(num+1)+\")\",2000);
4//ASTforCallExpression\_Identifier\_BinaryExpression
5\"type\":\"ExpressionStatement\",
6\"expression\":{
7\"type\":\"CallExpression\",
8\"callee\":{
9\"type\":\"Identifier\",
10\"name\":\"setTimeout\"
11},
12\"arguments\":[
13{
14\"type\":\"BinaryExpression\",
15\"operator\":\"+\",
16\"left\":{
17\"type\":\"BinaryExpression\",
18\"operator\":\"+\",
```  
Listing 2: A snippet of a JS code with CallExpression_Identifier_BinaryExpression. Listing 3 shows nested JS code function calls, where an attacker hides the function arguments in another function call to evade static analyses. We capture this attack pattern using the AST node \(-type\ CallExpression\_Identifier\_Literal\_CallExpression\). Listing 4 shows variable declarations, where \(e\) in \(line2\) is assigned to a function \(c\). We capture this attack pattern using the AST node \(type\ Assignment\_Expression\_Identifier\_FunctionExpression\). Listing 5 shows a JS code where the attacker attempts to detect the user environment, such as the operating system or the browser version. We capture this attack pattern using the AST node \(type\ VariableDeclarator\_Identifier\_LogicalExpression\). Listing 6 shows the JS code sample string concatenation and function obfuscation codes. We capture this attack pattern using the AST node \(type\ BinaryExpression\_BinaryExpression\). ```
1 varp26=newArray();
2 functionf85(g55,v27){
3p26[g55]=v27;
4j;
5 functionw25(h51){
6 returnh51;
7j;
8f85(763,w25(\"*\"));
9//ASTforCallExpressionUs_Identifier_Literal\_CallExpression
10\"type:\"ExpressionStatement\",
11\"expression\":\"
12 type:\"CallExpression\",
13\"callee\":{
14\"type:\"Identifier\",
15\"name\":\"f85\"
16}
17\"arguments\":[
18{
19 type:\"Literal\",
20\"value\":763,
21\"raw\":\"763\"
22},
23{
24\"type:\"CallExpression\",
```  
Listing 4: A snippet of a JS code with AssignmentExpression_Identifier_FunctionExpression. ```
1 eval{function(p,a,c,k,e,d){
2e=function(c){
3 return(c<a?