# Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens
## 4 Experiment
### Revised TF-IDF  
Figure 7 shows the average TF-IDF values over redirection tokens in 100 obfuscated benign JavaScript using the conventional TF-IDF. The TF-IDF average ranges from a minimum of 1.4 to a maximum of 16.99, with an average of 4.47. Figure 8 shows the average TF-IDF values over redirection tokens in 500 obfuscated malicious JavaScript using the conventional TF-IDF. The TF-IDF average ranges from a minimum of 1.42 to a maximum of 3.45, with an average of 2.30. To classify JavaScript containing redirection code, we use 3.43 as the threshold value. We classify JavaScript with a TF-IDF average that is less than the threshold value of those containing redirection code. In this case, the accuracy of the classification is 92.5%.  
Figure 9 shows the average TF-IDF values over redirection tokens in 100 obfuscated benign JavaScript using the revised TF-IDF. The TF-IDF average ranges from a minimum of 0.0006 to a maximum of 0.024, with an average of 0.004. Figure 10 shows the average TF-IDF values over redirection tokens in 500 obfuscated malicious JavaScript using the revised TF-IDF. The TF-IDF average ranges from a minimum of 0.008 to a maximum of 0.131, with an average of 0.049. Unlike the  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **No. of Data** & \begin{tabular}{c} **No. Detected as** \\ **Benign** \\ \end{tabular} & \begin{tabular}{c} **No. Detected as** \\ **Malicious** \\ \end{tabular} \\ \hline \hline \begin{tabular}{c} Obfuscated malicious JavaScript \\ \end{tabular} & 100 & 0 & 100 \\ \
\begin{tabular}{c} Obfuscated benign JavaScript \\ \end{tabular} & 100 & 47 & 53 \\
\begin{tabular}{c} Total \\ \end{tabular} & 200 & 47 & 153 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Classification result from malicious signature inspection.  
Figure 7: TF-IDF average values over redirection tokens in 100 obfuscated benign JavaScript using the conventional TF-IDF.  
conventional TF-IDF, the TF-IDF averages of the obfuscated redirection JavaScript are higher than those of the obfuscated benign JavaScript in the revised TF-IDF. To classify the JavaScript containing redirection code, we use 0.01 as the threshold value. We classify the JavaScript with an average TF-IDF greater than the threshold value as those containing redirection code. In this case, the accuracy of the classification is 96.8%.  
Table 8 summarizes the above experimental results. Overall, the revised TF-IDF shows better performance than the conventional TF-IDF in terms of accuracy, FPR, and FNR. In particular, when the  
Figure 8: TF-IDF average values over redirection tokens in 500 obfuscated malicious JavaScript using the conventional TF-IDF.  
Figure 10: TF-IDF average values over redirection tokens in 500 obfuscated malicious JavaScript using the revised TF-IDF.  
Figure 9: TF-IDF average values over redirection tokens in 100 obfuscated benign JavaScript using the revised TF-IDF.  
FPR is 0, the accuracy and FNR are extremely poor in the conventional TF-IDF. In conclusion, the proposed revised TF-IDF classifies obfuscated JavaScript better than the conventional TF-IDF.