Sheneamer Abdullah
Computer Science Department, Jazan University, Jazan, Saudi Arabia.
PeerJ Comput Sci. 2024 Feb 29;10:e1838. doi: 10.7717/peerj-cs.1838. eCollection 2024.
System security for web-based applications is paramount, and for the avoidance of possible cyberattacks it is important to detect vulnerable JavaScript functions. Developers and security analysts have long relied upon static analysis to investigate vulnerabilities and faults within programs. Static analysis tools are used for analyzing a program's source code and identifying sections of code that need to be further examined by a human analyst. This article suggests a new approach for identifying vulnerable code in JavaScript programs by using ensemble of convolutional neural networks (CNNs) models. These models use vulnerable information and code features to detect related vulnerable code. For identifying different vulnerabilities in JavaScript functions, an approach has been tested which involves the stacking of CNNs with misbalancing, random under sampler, and random over sampler. Our approach uses these CNNs to detect vulnerable code and improve upon current techniques' limitations. Previous research has introduced several approaches to identify vulnerable code in JavaScript programs, but often have their own limitations such as low accuracy rates and high false-positive or false-negative results. Our approach addresses this by using the power of convolutional neural networks and is proven to be highly effective in the detection of vulnerable functions that could be used by cybercriminals. The stacked CNN approach has an approximately 98% accuracy, proving its robustness and usability in real-world scenarios. To evaluate its efficacy, the proposed method is trained using publicly available JavaScript blocks, and the results are assessed using various performance metrics. The research offers a valuable insight into better ways to protect web-based applications and systems from potential threats, leading to a safer online environment for all.
基于Web的应用程序的系统安全性至关重要，为避免可能的网络攻击，检测易受攻击的JavaScript函数非常重要。长期以来，开发人员和安全分析师一直依靠静态分析来调查程序中的漏洞和故障。静态分析工具用于分析程序的源代码，并识别需要人工分析师进一步检查的代码段。本文提出了一种使用卷积神经网络（CNN）模型集成来识别JavaScript程序中易受攻击代码的新方法。这些模型利用漏洞信息和代码特征来检测相关的易受攻击代码。为了识别JavaScript函数中的不同漏洞，已经测试了一种方法，该方法涉及将CNN与不平衡、随机欠采样和随机过采样相结合。我们的方法使用这些CNN来检测易受攻击的代码，并改进当前技术的局限性。以前的研究已经介绍了几种识别JavaScript程序中易受攻击代码的方法，但往往有其自身的局限性，如准确率低、误报或漏报结果高。我们的方法通过利用卷积神经网络的力量来解决这个问题，并被证明在检测网络犯罪分子可能使用的易受攻击函数方面非常有效。堆叠式CNN方法的准确率约为98%，证明了其在实际场景中的鲁棒性和可用性。为了评估其有效性，使用公开可用的JavaScript代码块对所提出的方法进行训练，并使用各种性能指标对结果进行评估。该研究为更好地保护基于Web的应用程序和系统免受潜在威胁提供了有价值的见解，为所有人带来更安全的在线环境。
