ADSandbox: Sandboxing JavaScript to fight Malicious Websites

Dewald A, Holz T, Freiling F (2010)

Publication Type: Conference contribution, Original article

Publication year: 2010

Edited Volumes: Proceedings of the ACM Symposium on Applied Computing

Book Volume: SAC '10

Pages Range: 1859-1864

Edition: 1

Conference Proceedings Title: Proceedings of the 2010 ACM Symposium on Applied Computing

Event location: Sierre, Switzerland CH

ISBN: 978-1-60558-639-7

URI: http://doi.acm.org/10.1145/1774088.1774482

DOI: 10.1145/1774088.1774482

Abstract

We present ADSandbox, an analysis system for malicious websites that focusses on detecting attacks through JavaScript. Since, in contrast to Java, JavaScript does not have any built-in sandbox concept, the idea is to execute any embedded JavaScript within an isolated environment and log every critical action. Using heuristics on these logs, ADSandbox decides whether the site is malicious or not. In contrast to previous work, this approach combines generality with usability, since the system is executed directly on the client running the web browser before the web page is displayed. We show that we can achieve false positive rates close to 0% and false negative rates below 15% with a performance overhead of only a few seconds, what is a bit high for real time application, but supposes a great potential for future versions of our tool. © 2010 ACM.

Authors with CRIS profile

Andreas Dewald Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Felix Freiling Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Involved external institutions

Ruhr-Universität Bochum (RUB) DE Germany (DE)

How to cite

APA:

Dewald, A., Holz, T., & Freiling, F. (2010). ADSandbox: Sandboxing JavaScript to fight Malicious Websites. In Proceedings of the 2010 ACM Symposium on Applied Computing (pp. 1859-1864). Sierre, Switzerland, CH.

MLA:

Dewald, Andreas, Thorsten Holz, and Felix Freiling. "ADSandbox: Sandboxing JavaScript to fight Malicious Websites." Proceedings of the ACM Symposium on Applied Computing (SAC), Sierre, Switzerland 2010. 1859-1864.

BibTeX: Download