Obfuscated Malicious Script Response Technique Deployed at Host Level

Abstract

JavaScript functions have been remarkably enhanced thanks to the emergence of the next generation web standard HTML5 presented by W3C. HTML5 provides powerful functions that could replace non-standard technologies such as Active X by providing functions such as media play, 3-D graphic processing and Web socket communications using JavaScript only without the installation of separate plugins. Along with these trends in the ICT environment, many studies have been done related to threats exploiting JavaScript, which comprises a core of HTML5 functions. There are, however, many limitations in detecting obfuscated malicious scripts since most detection techniques use signature-based pattern matching. This paper will propose a method capable of detecting obfuscated malicious scripts at the host level and preventing the scripts’ execution.