Weaknesses in defenses against web-borne malware (short paper)

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Scopus citations


Web-based mechanisms, often mediated by malicious JavaScript code, play an important role in malware delivery today, making defenses against web-borne malware crucial for system security. This paper explores weaknesses in existing approaches to the detection of malicious JavaScript code. These approaches generally fall into two categories: lightweight techniques focusing on syntactic features such as string obfuscation and dynamic code generation; and heavier-weight approaches that look for deeper semantic characteristics such as the presence of shellcode-like strings or execution of exploit code. We show that each of these approaches has its weaknesses, and that state-of-the-art detectors using these techniques can be defeated using cloaking techniques that combine emulation with dynamic anti-analysis checks. Our goal is to promote a discussion in the research community focusing on robust defensive techniques rather than ad-hoc solutions.

Original languageEnglish (US)
Title of host publicationDetection of Intrusions and Malware, and Vulnerability Assessment - 10th International Conference, DIMVA 2013, Proceedings
Number of pages11
StatePublished - 2013
Externally publishedYes
Event10th Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2013 - Berlin, Germany
Duration: Jul 18 2013Jul 19 2013

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume7967 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349


Other10th Conference on Detection of Intrusions and Malware and Vulnerability Assessment, DIMVA 2013

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'Weaknesses in defenses against web-borne malware (short paper)'. Together they form a unique fingerprint.

Cite this