# Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens
## 4 Experiment
### Discussion  
We claimed that our lightweight AST can identify obfuscation type with 100% in Theorem 1. This was proved by the current obfuscation types. Theorem 1, however, can also be applied to new types of obfuscation algorithm which may emerge in the future. Figures 4 and 5 show similarities of JavaScript compared with type 1 obfuscated JavaScript. In contrast with Figure 4 showing experiment results using normal AST, Figure 5 shows some stable plateaus, giving hints that the JavaScript obfuscated by other types may exist. In this way, our lightweight AST can help detect new obfuscation as well.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**TF-IDF** & **Accuracy** & **FPR** & **FNR** \\ \hline \multirow{3}{*}{Conventional TF-IDF} & 92.5\% & 0.074 & 0.076 \\ \cline{2-4}  & 16.6\% & 0 & 0.833 \\ \cline{2-4}  & 91.3\% & 0.074 & 0 \\ \hline \multirow{3}{*}{Revised TF-IDF} & 96.8\% & 0.019 & 0.014 \\ \cline{2-4}  & 85.5\% & 0 & 0.465 \\ \cline{1-1} \cline{2-4}  & 95.8\% & 0.036 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Comparison performance of conventional TF-IDF and revised TF-IDF.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Analysis Time** & **Accuracy** & **Training** &
\begin{tabular}{c} **Required System** \\ **Resources** \\ \end{tabular} \\ \hline Dynamic analysis (JSUNPACK [24]) & 27.21 s & 100\% & none & high \\ Static analysis ([17]) & 0.024 s & 99.3\% & required & high \\ Proposed & 0.020 s & 96.8\% & none & low \\ \hline \hline \end{tabular}
\end{table}
Table 9: Performance comparison.  
We provide the obfuscation distinguishment function by improving AST. Additionally, we provide malicious JavaScript detection function by revising TF-IDF in a lightweight and fast manner. Table 9 compares our approach with the other approaches including dynamic analysis and deep learning based analysis. When compared to dynamic analysis, our approach has a little bit lower, but relatively comparable accuracy. Particularly, our approach can detect certain JavaScript that dynamic analysis cannot detect due to inapposite triggers. Furthermore, our approach uses relatively few resources and is over 100 times faster than dynamic analysis. When compared to deep learning based analysis requiring powerful computing resource, our approach uses very few resources and is 20% faster with 3% lower accuracy. Because of these advantages, our approach is specifically suitable to anti-virus or web browser on smartphones, which cannot support powerful computing resource required by dynamic analysis and deep learning. Furthermore, our approach can support smartphone users' real-time, but safe, web surfing by preventing drive-by-download attacks.  
Additionally, we briefly describe a means of achieving a complementary hybrid system by using our system first and then applying the other systems. In the real world, static and dynamic analyses are mostly used together when system resources are sufficient. When our system is combined with a dynamic analysis system, such as JSUNPACK, it first filters out benign JavaScript with 100% accuracy, which significantly reduces the workload in the dynamic analysis system. When combined with a machine learning-based static analysis system, such as that in [17], our system classifies the obfuscation types, which are then fed back into the static analysis system as a training dataset, leading to high accuracy.