Search

JavaScript obfuscation is a deliberate act of making a script difficult to understand by concealing its purpose. The prevalent use of obfuscation techniques to hide malicious codes and to preserve copyrights of benign scripts resulted in (i) missing detection of malicious scripts that are obfuscated and (ii) raising false alarms due to the benign scripts that are obfuscated. Automatic detection of obfuscated JavaScript is generally undertaken by tackling the problem from the readability perspective. Recently, Microsoft research team analyzed different levels of context-based features to distinguish obfuscated malicious scripts from obfuscated benign ones. In this work, we raise the issue of existing readable versions of obfuscated scripts. Further, we discuss the challenges posed by readably obfuscated scripts against both JavaScript malware detectors and obfuscated scripts detectors. Therefore, we propose JavaScript Obfuscation Detector ( JSOD), a completely static solution to detect obfuscated scripts including readable patterns. To evaluate JSOD, we compare it to the state-of-the-art approaches to detect obfuscated malicious and obfuscated benign script, namely, Zozzle and Nofus. Our experimental results demonstrate the importance to detect readably obfuscated scripts and their sophisticated variations. Furthermore, they also show the superiority of JSOD approach against all relevant solutions. Copyright © 2014 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

This paper proposes a hybrid architecture that combines correlation dimension and feature extraction techniques into the case-based reasoning (CBR) technique to do electrocardiogram (ECG) diagnosis. CBR is used in the system as the core problem-solving method, which applies the expert experience to analyze ECG and propose diagnosis. The correlation dimension values of ECGx are used for clustering of cases for CBR. A Min-Max Turning Points Selection (MTPS, algorithm is used to quickly extract turning points from an ECG waveform as wave features for retrieval of the most promising solution cases from a specific cluster of cases. Finally, the CBR can learn representative cases from the problem-solving process by an approximation-based training method. This hybrid architecture manifests several interesting features. First, high-quality representative cases can be effectively learned, thanks to the correlation dimension values-based clustering and approximation-based training methods. This feature not only reduces the number of cases needed to be stored in the case library, but improves the correctness of the proposed solutions. Second, the proposed MTPS algorithm for extraction of turning points is fast, simple and noise-tolerant, which helps a lot in the calculation of similarity among cases. Finally, the clustering algorithm can automatically re-cluster the cases in the case library in response to new diseases, which prevents our system from degradation due to the increase of new cases. Our experiments with the MIT-BIII arrhythmia database demonstrate that the architecture has very high sensitivity and specificity, as well as speedy response. [ABSTRACT FROM AUTHOR]