# Malicious JavaScript Detection Based on Bidirectional LSTM Model
## 5 Experiment and Result
### Learning the BLSTM Neural Network  
In this part, we introduce the hyper-parameter selection of the BLSTM neural network. The BLSTM neural network is implemented in Python with TensorFlow 2.0 and Keras. We experiment on a workstation with NVIDIA Quadro P4000 and Intel Xeon E5-2630 CPU operating at 2.50 GHz. Since malicious JavaScript detection is a binary classification task, we use cross-entropy as the loss function, i.e.,  
\[loss=-ylog\hat{y}+(1-y)log(1-\hat{y}) \tag{12}\]  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Name** & **Type** & **\#JS** \\ \hline \multirow{2}{*}{DB\_Raw} & benign & 30487 \\ \cline{2-3}  & malicious & 29893 \\ \hline \multirow{2}{*}{DB\_Ob} & benign & 9892 \\ \cline{2-3}  & malicious & 9721 \\ \hline \multirow{2}{*}{DB\_DeOb} & benign & 1516 \\ \cline{2-3}  & malicious & 1227 \\ \hline \hline \end{tabular}
\end{table}
Table 5: The datasets for BLSTM neural network.  
where \(y\) (0 for benign and 1 for malicious) is the label of the sample and \(\hat{y}\) is the output probability of the sample being malicious. We adopt Adam [53] as an optimizer, which is one of the most efficient optimizers at present. Then, we experiment with different combinations of hyper-parameters and compare the accuracy by 10 cross-validation. We will fix others when testing the influence of a hyper-parameter.  
1. Determined Input Vector Dimensions: First, we test the influence of different input vector dimensions. We fixed the number of BLSTM layers to 2 and the epoch to 10. Table 6 shows how the model's performance is affected by the different input vector dimensions. As we can see, the accuracy increases obviously when the dimension increases from 60 to 80, the bug gets lower when the dimension is set to 100. We also tested combinations of bigger dimensions and smaller dimensions, but their performances are poorer. This is because too big a dimension gives the sample pad too many zeros, which is useless for detecting malicious JavaScript, and too small a dimension makes the samples lose too many program features, which reduces the performance of the model. Therefore, the input vector dimension is set to 80.
2. Determined the number of epochs: Then we fixed the input vector dimension to 80 and test the influence of the number epoch. An epoch refers to one cycle through the full training dataset. An appropriate epoch can improve the performance of the model, but too large an epoch will only waste training time. As shown in Figure 7, when the number of epochs is from 1 to 6, the accuracy of the model continues to increase. When the number of epochs is greater than 6, the accuracy rate hardly changes. This means that when the number of epochs is 6, we can get better performance and less training time at the same time. Therefore, this hyper- parameter is set to 6.
3. Determined the Number of BLSTM Layers: After setting the number of epochs to 10, we test the influence of the number of the BLSTM layers. As Figure 8 shows, when the number of BLSTM  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Vector Dimensions** & **Accuracy** \\ \hline
60 & 78.49\% \\ \hline
70 & 80.68\% \\ \hline
**80** & **92.86\%** \\ \hline
90 & 89.13\% \\ \hline
100 & 87.57\% \\ \hline \hline \end{tabular}
\end{table}
Table 6: The influence of the input vector dimensions.  
Figure 7: The influence of the number of epochs.  
layers is from 1 to 3, the accuracy of the model continues to increase. When the number of BLSTM layers is greater than 3, the performance of the model shows a downward trend. Therefore, the number of the BLSTM layers is set to 3.