# Malicious JavaScript Detection Based on Bidirectional LSTM Model
## 3 Abstract Code Representation
### Program Dependency Analysis  
In order to generate _semantic slices_, we need to generate the Program Dependency Graph (PDG) of input programs, which can help us analyze the dependency between statements. For this purpose, we first parse the program to get the Abstract Syntax Tree (AST) of the program. Then, the Control Flaw Graph (CPG) is generated by adding control dependencies to the AST. Finally, the data dependencies are added to the CFG. Figure 3. shows how to generate PDG with an example.  
**Syntactic Analysis.** We leverage Esprima [33], a famous open source JavaScript parser, to take syntactic analysis. It takes a valid JavaScript sample as input and generates the corresponding AST. Overall, Esprima consists of 69 syntax units, which are divided into four categories: Expressions,  
Figure 3: The process from source code to abstract syntax tree to program dependency graph. (**a**) shows the sample code with an _if_ statement; (**b**) shows the Abstract Syntax Tree generated by the sample code; (**c**) shows the Program Dependency Graph generated by the Abstract Syntax Tree.  
Patterns, Statements, and Declarations. Figure 2(b) shows the parsing result, where the sample from Figure 2(a) is transformed into an AST. In order to make it easy to understand, this paper retains the variable name and constant value in the leaf node, but they are not part of the AST.  
The AST retains the structural information of the source code, but does not contain any control dependency and data dependency.  
**Control Flow Analysis.** Compared with the AST, the CFG is able to infer the conditions that must be met when executing a specific program path. To this end, statements are represented by nodes connected by directed edges to represent control flow. As shown in Figure 2(c), the CFG is constructed over the previous AST in order to preserve the relationship between nodes. We refer to the extension of the AST with control flow edges as CFG. There are many advantages to a CFG, for example, it can easily summarize the information of each statement, it can easily locate the code that is not accessible in the program, and it can easily find syntax structures such as loops in the CFG.  
To add control dependencies in the AST, we first traverse the AST and look for nodes with conditional syntax units, such as _IFStatement_ and _SwitchStatement_. Then we traverse the subtree of the node, and add control dependent edges between the parent and child nodes, that is, the green directed edges on Figure 2(c).  
**Data Flow Analysis.** Finally, we implemented the PDG, which extends the previous CFG with the data dependency. As shown in Figure 2(c), the nodes are connected with the directed blue edge if an element (e.g., variables, objects, function) defined or modified at source node is used at the target node. Because the PDG captures the data and control dependency between the different program components, it is not influenced by the order of statements. In addition, the PDG implementation follows the scoping rules of JavaScript and distinguishes between function declarations and function expressions. Also, the function call node is connected to the corresponding function definition node with data dependency, which define the PDG at the program level.