JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection

• Item type: Journal(1)
• 公開日: 2024-03-15
• タイトル: JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection
• タイトル / 言語: en
• タイトル: JABBERWOCK: A Tool for WebAssembly Dataset Generation and Its Application to Malicious Website Detection
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: [特集:若手研究者] malicious website detection, WebAssembly, JavaScript, dataset generation
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_6501
• 資源タイプ: journal article
• 著者所属: Graduate School of Information Science and Technology, Osaka University
• 著者所属: Graduate School of Information Science and Technology, Osaka University
• 著者所属: Graduate School of Information Science and Technology, Osaka University
• 著者所属: Graduate School of Information Science and Technology, Osaka University／National Institute of Technology
• 著者所属(英): en
• 著者所属(英): Graduate School of Information Science and Technology, Osaka University
• 著者所属(英): en
• 著者所属(英): Graduate School of Information Science and Technology, Osaka University
• 著者所属(英): en
• 著者所属(英): Graduate School of Information Science and Technology, Osaka University
• 著者所属(英): en
• 著者所属(英): Graduate School of Information Science and Technology, Osaka University / National Institute of Technology
• 著者名: Chika, Komiya; Naoto, Yanai; Kyosuke, Yamashita; Shingo, Okamura
• 著者名(英): Chika, Komiya; Naoto, Yanai; Kyosuke, Yamashita; Shingo, Okamura
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Machine learning is often used for malicious website detection, but an approach incorporating WebAssembly as a feature has not been explored due to a limited number of samples, to the best of our knowledge. In this paper, we propose JABBERWOCK (JAvascript-Based Binary EncodeR by WebAssembly Optimization paCKer), a tool to generate WebAssembly datasets in a pseudo fashion via JavaScript. Loosely speaking, JABBERWOCK automatically gathers JavaScript code in the real world, converts them into WebAssembly, and then outputs vectors of the WebAssembly as samples for malicious website detection. We experimentally evaluate JABBERWOCK from three perspectives. First, we measure its processing time. Second, we compare the samples generated by JABBERWOCK with the actual WebAssembly gathered from the Internet. Third, we investigate if JABBERWOCK can be used in malicious website detection. Regarding the processing time, we show that JABBERWOCK can construct a dataset in 4.5 seconds per sample for any number of samples. Next, comparing 10,000 samples output by JABBERWOCK with 168 gathered WebAssembly samples, we believe that the generated samples by JABBERWOCK are similar to those in the real world. We then show that JABBERWOCK can provide malicious website detection with 99% F1-score because JABBERWOCK makes a gap between benign and malicious samples as the reason for the above high score. We also confirm that JABBERWOCK can be combined with an existing malicious website detection tool to improve F1-scores. JABBERWOCK is publicly available via GitHub (https://github.com/c-chocolate/Jabberwock).; ------------------------------; This is a preprint of an article intended for publication Journal of; Information Processing(JIP). This preprint should not be cited. This; article should be cited as: Journal of Information Processing Vol.32(2024) (online); DOI http://dx.doi.org/10.2197/ipsjjip.32.298; ------------------------------
• 論文抄録(英) / 内容記述タイプ: Other
• 論文抄録(英) / 内容記述: Machine learning is often used for malicious website detection, but an approach incorporating WebAssembly as a feature has not been explored due to a limited number of samples, to the best of our knowledge. In this paper, we propose JABBERWOCK (JAvascript-Based Binary EncodeR by WebAssembly Optimization paCKer), a tool to generate WebAssembly datasets in a pseudo fashion via JavaScript. Loosely speaking, JABBERWOCK automatically gathers JavaScript code in the real world, converts them into WebAssembly, and then outputs vectors of the WebAssembly as samples for malicious website detection. We experimentally evaluate JABBERWOCK from three perspectives. First, we measure its processing time. Second, we compare the samples generated by JABBERWOCK with the actual WebAssembly gathered from the Internet. Third, we investigate if JABBERWOCK can be used in malicious website detection. Regarding the processing time, we show that JABBERWOCK can construct a dataset in 4.5 seconds per sample for any number of samples. Next, comparing 10,000 samples output by JABBERWOCK with 168 gathered WebAssembly samples, we believe that the generated samples by JABBERWOCK are similar to those in the real world. We then show that JABBERWOCK can provide malicious website detection with 99% F1-score because JABBERWOCK makes a gap between benign and malicious samples as the reason for the above high score. We also confirm that JABBERWOCK can be combined with an existing malicious website detection tool to improve F1-scores. JABBERWOCK is publicly available via GitHub (https://github.com/c-chocolate/Jabberwock).; ------------------------------; This is a preprint of an article intended for publication Journal of; Information Processing(JIP). This preprint should not be cited. This; article should be cited as: Journal of Information Processing Vol.32(2024) (online); DOI http://dx.doi.org/10.2197/ipsjjip.32.298; ------------------------------
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AN00116647
• 書誌情報: 情報処理学会論文誌; 巻 65, 号 3, 発行日 2024-03-15
• ISSN / 収録物識別子タイプ: ISSN
• ISSN / 収録物識別子: 1882-7764
• 公開者 / 言語: ja
• 公開者 / 出版者: 情報処理学会