Analiza i mjerenje izlaza obfuskatora JavaScript koda

undergraduate thesis

• Author: Matija Jelavić
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Marko Barišić (član povjerenstva)
• Committee member: Petar Paradžik (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2023-07-06, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Velika uloga programskog jezika JavaScript u web stranicama postaje meta koju napadači žele iskoristiti. Jedna od metoda koju koriste je obfuskacija, tehnika otežavanja čitanja izvornog koda. Detekcijom obfuskacije moguće je otkriti potencijalno zloćudni kod, a jedan od pristupa detekciji je strojno učenje.

U ovom radu je opisana obfuskacija i metode kojom se postiže te je potom opisan alat obfuscator.io i ukratko uspoređen sa svim ostalim javno dostupnim besplatnim obfuskatorima na temelju opcija i izlaza. Automatizacija usporedbe se može provesti alatom izrađenim za potrebe ovog rada kojim se došlo do zaključka da za potrebe generiranja skupa podataka za strojno učenje nije dovoljno koristiti jedan obfuskator, nego više njih s obzirom na to da funkcioniraju na različite načine i koriste različite mogućnosti JavaScript programskog jezika.

Abstract (english)

The large role of the JavaScript programming language in web pages is becoming a target that attackers want to exploit. One of the methods they use is obfuscation, a technique to make the source code harder to read. Detecting obfuscation can lead to revealing potentially malicious code, and one approach to detection is machine learning.

This paper describes obfuscation and the methods by which it is achieved. Later on it describes the obfuscator.io tool and briefly compares it, based on options and output, to all other publicly available free obfuscators. The automation of the comparison can be carried out with a tool created for the purposes of this work by help of which it was concluded that for the purposes of generating a dataset for machine learning, it is not enough to use one obfuscator, but several, because they function in different ways and use different capabilities of the JavaScript programming language.

• Keywords: obfuskacija; JavaScript; kibernetička sigurnost; obfuskatori
• Keywords (english): obfuscation; JavaScript; cybersecurity; obfuscators
• Language: croatian
• URN:NBN: urn:nbn:hr:168:042368
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-10-11 09:08:42