# Malicious JavaScript Detection Based on Bidirectional LSTM Model
## 3 Abstract Code Representation
### JavaScript Deobfuscation  
The obfuscation technique is widely used in JavaScript programs. On the one hand, benign obfuscation can protect intellectual property rights and prevent code from being plagiarized. On the other hand, to evade the detection of antivirus software and hide malicious intent, malicious JavaScript  
Figure 1: A brief review of abstract code representation.  
uses a variety of obfuscation techniques. This presents a challenge to malicious script detection. Several categories of obfuscation have been collected, as stated by [29; 30; 31], and they are discussed as follows:  
**(1)**: Randomization Obfuscation includes randomly inserting or modifying script elements without changing the semantics of the script, for example, adding whitespace characters, randomizing variable and function names. These operations invalidate content-based detectors.
**(2)**: Encoding obfuscation uses standard encoding or custom encoding to encode key variables and strings, making detection tools unable to identify real information.
**(3)**: Data obfuscation uses various operations to modify and regroup strings in programs, including, string concatenation, string splitting, and string replacement.
**(4)**: Logical obfuscation refers to adding functional-independent logical structures to the code, such as a large number of conditional branch statements.  
It should be noted that the obfuscation technique is not one technique but a combination of multiple techniques, which brings potential risks to the deep learning-based classifier for detecting malicious JavaScript. For example, the training dataset for the neural network is mainly composed of encoding obfuscated samples, in which there are a large number of encoded variables in the program, then the trained neural network model may only tend to identify samples with abundant number of encoded variables as malicious script. This makes the classifier more prone to false positives when detecting samples processed by other obfuscation techniques.  
To solve this problem, we need to deobfuscate the samples. We select JSDetox [32] and other 5 online JavaScript deobfuscation tools to process the samples. JSDetox is a famous JavaScript deobfuscation tool which can analyze the given code and tries to solve calculations through static analysis of the code. As shown in Figure 2, in the original code, the parameter of _document.createElement()_ is the result of an anonymous function calculation. Through the processing of JSDetox, the calculation results of the variables _XoNo_ and _apoc_ are placed in the correct position of the _document.createElement()_.  
After further analysis, we find that the obfuscation techniques lead to huge changes in the results of static analysis (e.g., lexical analysis, syntactic analysis) of the code. Table 1 shows the statistic result of the code in Figure 2 after lexical analysis and syntactic analysis. The statistic result shows the obfuscation increases the number of tokens and the number of AST nodes by 3 and 2 times, respectively. These changes inevitably distort features extracted at the lexical level and syntactic level. Also, this indicates the necessary to leverage the deobfuscated samples to train a neural network.  
\begin{table}
\begin{tabular}{c c} \hline \hline \multicolumn{1}{c}{**State**} & **\#Token** & **\#AST Node** \\ \hline Original code & 30 & 24 \\ \hline Analysis result & 9 & 10 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Statistical results after static analysis of the code in Figure 2.  
Figure 2: An example of deobfuscation using JSDetox. (**a**) shows the original code; (**b**) shows the analysis result.