ZOZZLE: Fast and Precise In-Browser JavaScript Malware Detection

By Charlie Curtsinger, Benjamin Livshits, B. Zorn, Christian Seifert. 2011

344 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Poisoning Attacks against Support Vector Machines (2012, methodology): “…approaches have already been used or proposed as solutions to a number of such security-sensitive tasks including spam, worm, intrusion and fraud detection (Meyer & Whateley, 2004; Biggio et al., 2010; Stolfo et al., 2003; Forrest et al., 1996; Bolton & Hand, 2002; Cova et al., 2010; Rieck et…”
Towards Making Systems Forget with Machine Unlearning (2015, background): “For instance, with a real-world data set from Huawei (see §VII), it takes Zozzle [35], a JavaScript malware detector, over a day to retrain and forget a polluted sample.”
Static detection of malicious JavaScript-bearing PDF documents (2011, methodology): “One can use the mostly static technique proposed in Zozzle [8] in which compilation requests to a JavaScript engine are intercepted to obtain all code sent for execution.”
Anything to Hide? Studying Minified and Obfuscated Code in the Web (2019, background): “[7] extract features from AST nodes while preserving the context of nodes.”
CAMP: Content-Agnostic Malware Protection (2013, background): “For example, the index analysis|domain:"foo.com"|urls measures how many different URLs under the domainfoo.com were analyzed by the binary analysis system and how often they were labeled malicious, i.e. for the 7-day time period, the analyzer checked20 URLs from foo.com and found one of them…”
TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time (2018, methodology): “The use of k-fold CV is widespread in malware classification research [8, 9, 22, 25, 28, 30, 33, 40, 41, 46]; while a commonmechanism to prevent overfitting [6], it is ill-suited for estimating the real-world performance of machine learning techniques with non-stationary data (e.”
Looking at the bag is not enough to find the bomb: an evasion of structural methods for malicious PDF files detection (2013, methodology): “For instance, Jsand [19], Cujo [31], Zozzle [21], Prophiler [18] are well-known tools for the dynamic and static analysis of JavaScript code.”
Finding the Linchpins of the Dark Web: a Study on Topologically Dedicated Hosts on Malicious Web Infrastructures (2013, methodology): “All together, we have gathered about 5.5 million initial URLs, which serve as inputs to a set of crawlers described below during a 7-month period to collect data.”