论文标题
优化JavaScript混淆
Optimizing Away JavaScript Obfuscation
论文作者
论文摘要
JavaScript是一种流行的攻击向量，用于在毫无戒心的互联网用户中释放恶意有效载荷。这种恶意JavaScript的作者经常采用多种混淆技术，以防止通过专业恶意软件分析师通过防病毒和阻碍手动分析进行自动检测。因此，本文提出了Safe Deobs，这是我们构建的JavaScript Deobfuscation工具。 保险箱的目的是自动删除JavaScript恶意软件，以便分析师可以更快地确定恶意脚本的意图。这是通过编译器理论技术启发的许多静态分析来实现的。我们通过对现实世界JavaScript恶意软件的案例研究证明了保险箱的实用性，并证明它是恶意软件分析师工具集的有用补充。
JavaScript is a popular attack vector for releasing malicious payloads on unsuspecting Internet users. Authors of this malicious JavaScript often employ numerous obfuscation techniques in order to prevent the automatic detection by antivirus and hinder manual analysis by professional malware analysts. Consequently, this paper presents SAFE-Deobs, a JavaScript deobfuscation tool that we have built. The aim of SAFE-Deobs is to automatically deobfuscate JavaScript malware such that an analyst can more rapidly determine the malicious script's intent. This is achieved through a number of static analyses, inspired by techniques from compiler theory. We demonstrate the utility of SAFE-Deobs through a case study on real-world JavaScript malware, and show that it is a useful addition to a malware analyst's toolset.
