# Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens
## 4 Experiment
### Lightweight AST
#### 4.2.3 Classification Accuracy of Obfuscation Type Using Lightweight AST
Figure 5: Structure similarity of data compared with obfuscation type 1 in a lightweight AST. Figure 6: Classification result according to the obfuscation type 1 threshold in a lightweight AST. Table 6 shows the results of the measurement classification accuracy, FPR, and FNR according to the threshold values of the conventional and lightweight ASTs, respectively. From these results, it is evident that the findings for obfuscation types 2 to 4 are similar to those for obfuscation type 1. When using the conventional AST, the results differ according to the priority of the accuracy, FPR, and FNR. Nevertheless, when using the lightweight AST, there are threshold values that meet all three criteria in all obfuscation types. The accuracy of classifying each obfuscation type of the lightweight AST is 100%. In conclusion, the lightweight AST is more efficient for classification of obfuscation types compared to the conventional AST. Furthermore, newly inserted obfuscation cases will share a certain similarity value, which will not match 100% of any existing obfuscation case. When a system shows multiple JavaScript with a certain similarity value, we can speculate that new obfuscation type could be used for attacks. This speculation can be verified after conducting in-depth analysis of the suspicious obfuscated JavaScript(s). \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Obfuscation Type**} & \multicolumn{2}{c}{**Conventional AST**} & \multicolumn{2}{c}{**Lightweight AST**} \\ \cline{2-5}  & **Priority** & **Threshold** & **Result** & **Threshold** & **Result** \\ \hline \multirow{7}{*}{Type 1} & \multirow{3}{*}{Maximum accuracy} & \multirow{3}{*}{0.66} & Accuracy: 0.93 & \multirow{3}{*}{0.76-1} & \multirow{3}{*}{0.76-1} \\  & & & FPR: 0.01 & & \\  & & & FNR: 0.68 & & \\ \cline{2-5}  & \multirow{3}{*}{Minimum FPR} & \multirow{3}{*}{0.82-1} & Accuracy: 0.91 & \multirow{3}{*}{0.76-1} & Accuracy: 1 \\  & & & FNR: 0.99 & & FNR: 0 \\ \cline{2-5}  & \multirow{3}{*}{Minimum FNR} & \multirow{3}{*}{0-0.47} & Accuracy: 0.73 & \multirow{3}{*}{0.73} & \multirow{3}{*}{0.76-1} \\  & & & FPR: 0.29 & & \\  & & & FNR: 0 & & \\ \hline \multirow{7}{*}{Type 2} & \multirow{3}{*}{Maximum accuracy} & \multirow{3}{*}{0.66} & Accuracy: 0.96 & \multirow{3}{*}{0.87-1} & Accuracy: 1 \\  & & & FPR: 0.01 & & \\ \cline{2-5}  & \multirow{3}{*}{Minimum FPR} & \multirow{3}{*}{0.77–1} & Accuracy: 0.93 & \multirow{3}{*}{0.87-1} & FPR: 0 \\  & & & FNR: 0 & & FNR: 0 \\ \cline{2-5}  & \multirow{3}{*}{Minimum FNR} & \multirow{3}{*}{0-0.55} & Accuracy: 0.88 & \multirow{3}{*}{0.82-1} & \multirow{3}{*}{0.87-1} \\  & & & FPR: 0.12 & & \\ \cline{2-5}  & \multirow{3}{*}{Maximum accuracy} & \multirow{3}{*}{0.5} & Accuracy: 0.97 & \multirow{3}{*}{0.87-1} & \multirow{3}{*}{0.86-1} \\  & & & FPR: 0.002 & & \\ \cline{2-5}  & & & FNR: 0.26 & & \\ \cline{2-5}  & \multirow{3}{*}{Minimum FPR} & \multirow{3}{*}{0.56–1} & Accuracy: 0.96 & \multirow{3}{*}{0.82-1} & Accuracy: 1 \\  & & & FNR: 0.37 & & \\ \cline{2-5}  & \multirow{3}{*}{Minimum FNR} & \multirow{3}{*}{0-0.22} & Accuracy: 0.32 & \multirow{3}{*}{0.88-1} & \multirow{3}{*}{0.87-1} \\  & & & FNR: 0 & & FNR: 0 \\ \hline \multirow{7}{*}{Type 3} & \multirow{3}{*}{Minimum FPR} & \multirow{3}{*}{0.89–1} & Accuracy: 0.91 & \multirow{3}{*}{0.88-1} & Accuracy: 1 \\  & & & FPR: 0.96 & & FNR: 0 \\ \cline{2-5}  & \multirow{3}{*}{Minimum FNR} & \multirow{3}{*}{0-0.55} & Accuracy: 0.78 & \multirow{3}{*}{0.88-1} & \multirow{3}{*}{0.87-1} \\  & & & FPR: 0.23 & & \\ \cline{2-5}  & & & FNR: 0 & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Classification accuracy, FPR, and FNR according to the threshold in conventional and lightweight ASTs.