CSI5387: Data Mining Project

Web pages have become more like applications that documents. Not only do they provide dynamic content, they also allow users to play games, send email, and do many other tasks that used to be reserved for traditional applications. One of the major technologies enabling web application creation is JavaScript, which allows execution of code in the browser. Unfortunately, because it is so powerful, JavaScript is also abused by attackers. Often, the only suggested defense against malicious web scripts is to disable JavaScript [2]. Unfortunately, doing so disables much of the functionality of some web pages, and completely breaks others. As such, disabling JavaScript is not a viable option for many people, and few other options exist for protection from malicious web code. Users might gain some protection if it were possible for them to run some JavaScript rather than only having the option of all or none. People might only really need to see menu code, or code that displays videos, and want to discard anything else. However, if we are to apply this sort of protection on existing web pages, there needs to be some way to determine class automatically. For this project, I’ve chosen two classes to distinguish. The first is code used for displaying JavaScript menus, which is probably a fairly low-risk type of JavaScript that many users would wish to run. The second is advertising JavaScript, which is often more complex and may be something users wish to disable. Although it might have been more interesting from a security perspective to use malicious JavaScript as one of my classes, this data would be more difficult to gather. Since at the outset I was not even sure JavaScript could be classified in this manner, it seemed best to use easier-to-obtain training samples. The goal of this project is to learn whether the “bag of words” approach used provides suitable attributes for classification, to explore properties of the resulting feature space, and to determine if reasonable accuracy could be achieved in distinguishing the two classes defined.