# Malicious JavaScript Detection Based on Bidirectional LSTM Model
## 4 Malicious JavaScript Detection Model
### Structure of BLSTM  
In this section, we introduce the structure of the BLSTM neural network for detecting malicious JavaScript (the training parameters of the neural network are discussed in Section 5.3). As shown in Figure 5, this model consists of an output layer, a dense layer, and multiple BLSTM layers. The input of the model requires a fixed-length vector, which is a vector representation corresponding to a _semantic slice_. The dense layer is used to compress the dimension of the output vector of the BLSTM layer. The output layer collects the vector from the dense layer and outputs the probability of classification.  
The BLSTM layer is the most critical part of the model. It is established by stacking multiple LSTM cells. These LSTM cells are chain-structured and process input information in both forward and backward directions. Each LSTM defines and maintains a memory cell throughout the whole life cycle, which is the most important element of the LSTM. As Figure 6 shows, the previous cell state \(c_{t-1}\) interacts with the previous cell output \(h_{t-1}\) and the present input \(x_{t}\) to determine which elements of the internal state vector should be updated, maintained or forgotten. Three gates are defined to control the changes of the memory cell state. The forget gate \(f_{t}\) decides what information to throw away from the cell state, the input gate \(i_{t}\) decides what new information to store in the cell state, and the output gate \(o_{t}\) decides what to output.  
The details of calculation are shown below, where \(\sigma\) is the sigmoid function, \(tanh\) is the hyperbolic tangent function, \(c_{t}\) is the cell state, and \(h_{t}\) is the cell output. \(W_{xi}\), \(W_{hi}\), \(W_{xf}\), \(W_{hf}\), \(W_{xc}\), \(W_{hc}\), \(W_{xo}\) and \(W_{ho}\) are weight matrixes for the corresponding input of the network activation functions. \(b_{i}\), \(b_{f}\), \(b_{c}\), and \(b_{o}\) are bias vectors.  
\[i_{t}=\sigma(W_{xi}x_{t}+W_{hi}h_{t-1}+b_{i}) \tag{1}\]  
\[f_{t}=\sigma\Big{(}W_{xf}x_{t}+W_{hf}h_{t-1}+b_{f}\Big{)} \tag{2}\]  
\[c_{t}=f_{t}c_{t-1}+i_{t}tanh(W_{xc}x_{t}+W_{hc}h_{t-1}+b_{c}) \tag{3}\]  
\[o_{t}=\sigma(W_{xo}x_{t}+W_{ho}h_{t-1}+b_{o}) \tag{4}\]  
\[h_{t}=o_{t}tanh(c_{t}) \tag{5}\]  
Since each BLSTM layer contain a forward LSTM layer and a backward LSTM layer, the calculation of output vector \(h_{t}\) is separated into forward output \(\overset{\rightarrow}{h}_{t}\) and backward output \(\overset{\leftarrow}{h}_{t}\). The forward output \(\overset{\rightarrow}{h}_{t}\) is iteratively calculated using input in a positive sequence from time 0 to time \(T\), while the backward  
Figure 5: A brief review of the Bidirectional Long Short-Term Memory (BLSTM) neural network.  
Figure 6: The structure of a typical Long Short-Term Memory (LSTM) cell. The circles represent pointwise operations, e.g., vector addition, and the rectangles are the gates. Lines merging denote concatenation, a line forking denotes its content being copied and the copies going to different locations.  
output \(\overleftarrow{h}_{t}\) is calculated using the reversed input from time \(T\) to time 0. Equations (6) and (7) give the details, where \(W\underset{x\overrightarrow{h}}{\rightarrow}\), \(W\underset{h\overrightarrow{h}}{\rightarrow}\), \(W\underset{x\overrightarrow{h}}{\leftarrow}\), \(W\underset{h\overrightarrow{h}}{\leftarrow}\) are weight matrixes and \(b\underset{h}\), \(b\underset{h}\) are bias vectors.  
\[\overrightarrow{h}_{t}=\sigma\Big{(}W\underset{x\overrightarrow{h}}{ \rightarrow}x_{t}+W\underset{h\overrightarrow{h}}{\rightarrow}\overset{ \rightarrow}{h}t_{t-1}+b\underset{h}{\rightarrow}\Big{)} \tag{6}\]  
\[\overleftarrow{h}_{t}=\sigma\Big{(}