# Lightweight Detection Method of Obfuscated Landing Sites Based on the AST Structure and Tokens
## Proposed System
### Lightweight AST
#### 3.2.2 Reduction Rate of the Lightweight AST
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Type of AST Node** & **Nonstructural Node Ratio** & **Type of AST Node** & **Nonstructural Node Ratio** \\ \hline ArrayExpression & \(\frac{1}{E+2}\) & ReturnStatement & \(\frac{1}{E+2}\) or 1 \\ \hline ObjectExpression & \(\frac{E+2}{3E+4}\) & LabeledStatement & \(\frac{S+2}{2S+3}\) \\ \hline FunctionExpression & \(1\) & BreakStatement & \(\frac{1}{2}\) or 1 \\ \hline UnaryExpression & \(\frac{E+2}{2E+3}\) & ContinueStatement & \(\frac{1}{2}\) or 1 \\ \hline UpdateExpression & \(\frac{E+2}{2E+3}\) & IfStatement & \(\frac{S+2}{(S+1)(E+1)+(S+2)}\) \\ \hline BinaryExpression & \(\frac{2^{i+2}-1}{2^{i+3}-2}\) & SwitchStatement & \(\frac{S+2}{(S+1)(E+2)+(S+2)}\) \\ \hline AssignmentExpression & \(\frac{2^{i+3}-1}{2^{i+3}-2}\) or \(\frac{2E+3}{2E+4}\) & ThrowStatement & \(\frac{1}{E+2}\) \\ \hline LogicalExpression & \(\frac{2^{i+2}-1}{2^{i+3}-2}\) & TryStatement & \(\frac{1}{2S+3}\) \\ \hline MemberExpression & \(\frac{2^{i+1}}{2^{i+2}-1}\) & WhileStatement & \(\frac{S+2}{(S+1)(E+1)+(S+2)}\) \\ \hline ConditionalExpression & \(\frac{3^{i+3}}{1+\frac{5^{i+3}}{2^{i+3}}}\) & DoWhileStatement & \(\frac{S+2}{(S+1)(E+1)+(S+2)}\) \\ \hline CallExpression & \(\frac{2^{i+3}}{2^{i+3}-2}\) & ForStatement & \(\frac{1}{S+2}\) \\ \hline NewExpression & \(1\) & ForInStatement & \(\frac{2S+3}{(S+1)(E+3)+(2S+3)}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Obfuscation Type** & \(E\) & **S** & **Analytical Representative Minimum Node Reduction Rate** \\ \hline Type 1 & 9 & 8 & 5.2\% \\ Type 2 & 5 & 6 & 6.6\% \\ Type 3 & 5 & 3 & 11.1\% \\ Type 4 & 5 & 3 & 11.1\% \\ Type 5 & 8 & 3 & 11.1\% \\ Type 6 & 6 & 2 & 14.2\% \\ Type 7 & 3 & 3 & 11.1\% \\ Type 8 & 4 & 5 & 7.6\%  
Structure comparison time reduction rate. \[=1-\frac{\text{the time complexity of lightweight AST}}{\text{the time complexity of conventional AST}}\] \[=1-\frac{\text{the time complexity of lightweight AST}}{\text{the time complexity of conventional AST}}\] \[\qquad\qquad=1-\frac{(1-\text{x})\text{n log}(1-\text{x})\text{n }}{\text{n logn}}\] \[\qquad\qquad=1-\frac{(1-\text{x})(\log(1-\text{x})+\text{logn})}{ \text{logn}}.\]  
Here, n is larger than \((1-\text{x})\text{n}\). The maximum reduction rate is 1 because \(\frac{\log(1-\text{x})\text{n}}{\text{logn}}\) is 0 when \((1-\text{x})\text{n}\) is 1, and the minimum reduction rate is x because \(\lim\limits_{\text{n}\rightarrow\infty}\frac{(1-\text{x})(\log(1-\text{x})+ \text{logn})}{\text{logn}}=1-\text{x}\). Therefore, the structure comparison time reduction rate is higher than the node reduction rate, which ranges from x to 1. In addition, the extraction time of the lightweight AST is longer than that of the conventional one. Nevertheless, it can be ignored because the process that distinguishes the AST structural node and AST nonstructural node occurs within the same time period as the AST transformation. Moreover, it has an O(\(n\)) complexity that is lower than O(_nlogn_) of SimHash. Therefore, the lightweight AST reduces the structure comparison time.