Analysis and detection of malicious Javascript code

Kako je Internet postao važan dio naše svakodnevice, tako su i razni napadi putem njega postali sve ćešći. Jedan od izvora takvih napada je upravo JavaScript kod. U ovome radu pokušava se detektirati takav zlonamjerni JavaScript kod tehnikama strojnog učenja. Iz JavaScript koda izgradi se apstraktno sintaksno stablo iz kojeg se pomoću DFS algoritma dobiju sekvence sintaktičkih jedinica. Zatim se koristi Word2Vec model kako bi se dobila numerička reprezentacija tih sintaktičkih jedinica. Učeni su modeli unaprijedna slojevita neuronska mreža, LSTM te BiLSTM te je pokazano kako BiLSTM daje najbolje rezultate.As the Internet has become an important part of our everyday lives, the attacks by its means became more pervasive too. One of the sources of such attacks is JavaScript. In this thesis, a model for detecting malicious JavaScript is proposed. An AST tree is built from JavaScript source code and converted to a sequence of syntactic units by a depth-first search algorithm. Moreover, a Word2Vec model is used to obtain a numeric representation of the syntactic units. Three models are trained: feed-forward neural network, LSTM, and BiLSTM. The BiLSTM model turned out to give the best results