Static Semantics Reconstruction for Enhancing JavaScript-WebAssembly Multilingual Malware Detection

arXiv:2310.17304v2 Announce Type: replace
Abstract: The emergence of WebAssembly allows attackers to hide the malicious functionalities of JavaScript malware in cross-language interoperations, termed JavaScript-WebAssembly multilingual malware (JWMM). However, existing anti-virus solutions based on static program analysis are still limited to monolingual code. As a result, their detection effectiveness decreases significantly against JWMM. The detection of JWMM is challenging due to the complex interoperations and semantic diversity between JavaScript and WebAssembly. To bridge this gap, we present JWBinder, the first technique …

analysis arxiv attackers code cs.cr cs.se detection hide javascript javascript malware language malicious malware malware detection program program analysis result semantics solutions virus webassembly