# Malicious JavaScript Detection Based on Bidirectional LSTM Model
## 3 Abstract Code Representation
### Program Slices Generation  
Before generating program slices, we need to choose the appropriate _key function_, which can guide the slicing to cover as many possible malicious statements as possible. We selected 2000 malicious scripts from the dataset (detailed in Section 5) and performed statistical analysis to study the features of API function calls. There are many studies that demonstrate the usefulness of API function calls for malicious script detection as well, such as [34; 35]. Combining existing research with our statistical results, the _key functions_ are divided into 4 categories according to their features. Table 2 shows the API functions corresponding to each category of _key functions_. String Operations: The API functions regarding string are widely used in malicious JavaScript. These functions are used by attackers to obfuscate code, which allows malicious scripts to evade the detection of most programmers. Encoding Operations: Similar to string operations, the API functions regarding encoding encode variables and strings, making the attack scripts difficult to understand. \begin{table}
\begin{tabular}{l l c} \hline \hline
**No** & **Categories** & **API Functions** \\ \hline
1 & String Operation & _substring(), charAt(), split(), concat(), slice(), substr()_ \\ \hline
2 & Encoding Operation & _escape(), unescape(), string(), fromCharCode()_ \\ \hline
3 & URL Redirection & _setTimeout(), location.reload(), location.replace(), ducument.URL(),_ \\  & _document.location (), document.refer(),_ \\ \hline
4 & Specific Behaviors & _eval(), setTime(), setInterval(), ActiveXObject(), createElement(),_ \\  & _document.write(), document.writln(), document.replaceChildren()_ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The _key functions_ categories. URL Redirection: JavaScript-based redirection technology is widely used in malicious pages to redirect spam. Specific Behaviors: Malicious scripts frequently execute specific instructions dynamically, for example, use the _document.replaceChildren()_ function to dynamically manipulate the document object model tree and plant malicious links into web pages. When we implement program slicing, for convenience, all these _key functions_ are divided into forward functions and backward functions according to the position of the dependent statement. The forward function receives parameters from an external input, such as a file or HTTP request. For example, the _eval_ function is a forward function because its arguments must come from the previous statement. The backward function is that when the program runs, it does not need to receive parameters from the external environment. Program slicing has 3 steps:  
1. Traverse the PDG of the input program to find a specific node. This node can hint that there is a _key function_ in the statements, such as _CallExpression_, _FunctionDeclaration_, or _VariableDeclaration_. 2. Check the name attribute of the specific node found in step 1. If it is one of the key functions, traverse along the edges of the data dependency and control dependency to find all nodes that have a dependency relationship with the specific node. 3. Collect statements corresponding to all the nodes found in step 2. Then sort these statements in the order of the input samples to generate program slices. For ease of understanding, we leverage an example to illustrate the slicing process. The source code in Figure 4 shows an example with an _eval_ function. Then, we generate the PDG (for the sake of clarity, we simplified the PDG), where the blue edges indicate data dependency, the green directed edges indicate control dependency, and the number indicates the line number of the node corresponding statement. In order to generate program slice, we first traverse the PDG of the source code and find that the gray node is a _CallExpression_ node. We further found that the name attribute of this node is an _eval_ function, which is one of the _key functions_.