aurore54f/jast

Syntactic detection of malicious (obfuscated) JavaScript files

jast's Issues

Missing ground truth?

Is there a way to supply ground truth to the classifier? The example provided works fine, but does output the message:

WARNING: No ground truth given: unable to evaluate the accuracy of the classifier's predictions

Remove default arguments with fixed paths

Some functions have default parameters which look like fileDir = '/home/...'. Are these dafault arguments really needed? If yes, a relative path would be better as in the current version the home directory is hard coded.

Token dictionary for Esprima generated every time

Why is the dictionary in DicoOfAstEsprimaProduction.py generated every time? IMHO it would be better to generate it once and store it in a constant.

Missing Documentation

Please provide an explanation what this code repository is about.

Difference with JStap

Nice job !

I red your code JStap, I just wanted to quickly understand, what are the differences with this project?

Thank you

Returning an undefined variable on exception

In NGramsRepresentation.py:

	# return DicoIntToNGrams.dicoIntToNGrams[str(i)];
	try:
		ngram = dico[str(i)];
		return ngram;
	except KeyError as e:
		print('The key ' + str(e) + ' is not in the dictionary.')
		pass;
        return ngram;

On an exception ngram is not defined and the return statement will fail.

Please run pylint

The code quality could be improved by using "pylint".

some questions about the codes and the publication

hello,
I'm a new learner to classifying malicious and benign javascripts, and I'm very interested in reading this project and the paper. However I met some confusions. Please help me.

1. In the publication Table 1, there states all possible N-grams. In my opinion, 1-gram should be 26 and 2-grams should be 26^2, but in the table, it's different. Could you explain why?
2. For example, a declaration line "var goodluck" can be parsed as "Identifier: Name: "goodluck"". In the project, is the N-gram method applied to only "Identifier: Name" or the complete string including "goodluck"？ For the reason of obfuscation, including "goodluck" seems not be a good idea.

Thanks very much!