{"id":"https://openalex.org/W2116761843","doi":"https://doi.org/10.1109/ntms.2011.5720649","title":"Term-Rewriting Deobfuscation for Static Client-Side Scripting Malware Detection","display_name":"Term-Rewriting Deobfuscation for Static Client-Side Scripting Malware Detection","publication_year":2011,"publication_date":"2011-02-01","ids":{"openalex":"https://openalex.org/W2116761843","doi":"https://doi.org/10.1109/ntms.2011.5720649","mag":"2116761843"},"language":"en","primary_location":{"id":"doi:10.1109/ntms.2011.5720649","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms.2011.5720649","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2011 4th IFIP International Conference on New Technologies, Mobility and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5043016218","display_name":"Gr\u00e9gory Blanc","orcid":"https://orcid.org/0000-0001-8150-6617"},"institutions":[{"id":"https://openalex.org/I75917431","display_name":"Nara Institute of Science and Technology","ror":"https://ror.org/05bhada84","country_code":"JP","type":"education","lineage":["https://openalex.org/I75917431"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Gregory Blanc","raw_affiliation_strings":["Graduate School of Information Science, Nara Institute of Science and Technology, Ikoma, Nara, Japan","Grad. Sch. of Inf. Sci., Nara Inst. of Sci. & Technol., Nara, Japan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Science, Nara Institute of Science and Technology, Ikoma, Nara, Japan","institution_ids":["https://openalex.org/I75917431"]},{"raw_affiliation_string":"Grad. Sch. of Inf. Sci., Nara Inst. of Sci. & Technol., Nara, Japan#TAB#","institution_ids":["https://openalex.org/I75917431"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103073084","display_name":"Ruo Ando","orcid":"https://orcid.org/0000-0002-9279-8333"},"institutions":[{"id":"https://openalex.org/I1317171322","display_name":"National Archives and Records Administration","ror":"https://ror.org/032214n64","country_code":"US","type":"archive","lineage":["https://openalex.org/I1317171322"]},{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP","US"],"is_corresponding":false,"raw_author_name":"Ruo Ando","raw_affiliation_strings":["National Institute of Information and Communications Technology, Koganei, Tokyo, Japan","Nat. Nara Inst. of Inf. & Commun. Technol., Tokyo, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology, Koganei, Tokyo, Japan","institution_ids":["https://openalex.org/I90023481"]},{"raw_affiliation_string":"Nat. Nara Inst. of Inf. & Commun. Technol., Tokyo, Japan","institution_ids":["https://openalex.org/I1317171322"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5084740320","display_name":"Youki Kadobayashi","orcid":null},"institutions":[{"id":"https://openalex.org/I75917431","display_name":"Nara Institute of Science and Technology","ror":"https://ror.org/05bhada84","country_code":"JP","type":"education","lineage":["https://openalex.org/I75917431"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Youki Kadobayashi","raw_affiliation_strings":["Graduate School of Information Science, Nara Institute of Science and Technology, Ikoma, Nara, Japan","Grad. Sch. of Inf. Sci., Nara Inst. of Sci. & Technol., Nara, Japan#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Graduate School of Information Science, Nara Institute of Science and Technology, Ikoma, Nara, Japan","institution_ids":["https://openalex.org/I75917431"]},{"raw_affiliation_string":"Grad. Sch. of Inf. Sci., Nara Inst. of Sci. & Technol., Nara, Japan#TAB#","institution_ids":["https://openalex.org/I75917431"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":12,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8579587340354919},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8575975894927979},{"id":"https://openalex.org/keywords/cross-site-scripting","display_name":"Cross-site scripting","score":0.8226447105407715},{"id":"https://openalex.org/keywords/javascript","display_name":"JavaScript","score":0.8075087070465088},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.7763591408729553},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.7250860929489136},{"id":"https://openalex.org/keywords/scripting-language","display_name":"Scripting language","score":0.705379843711853},{"id":"https://openalex.org/keywords/web-application","display_name":"Web application","score":0.5576015710830688},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.5389633178710938},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5365604758262634},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.47710520029067993},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.44798970222473145},{"id":"https://openalex.org/keywords/rewriting","display_name":"Rewriting","score":0.4206565320491791},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4159350097179413},{"id":"https://openalex.org/keywords/client-side","display_name":"Client-side","score":0.4132028818130493},{"id":"https://openalex.org/keywords/web-application-security","display_name":"Web application security","score":0.2425304651260376},{"id":"https://openalex.org/keywords/web-development","display_name":"Web development","score":0.22299465537071228},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.20967978239059448}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8579587340354919},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8575975894927979},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.8226447105407715},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.8075087070465088},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.7763591408729553},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.7250860929489136},{"id":"https://openalex.org/C61423126","wikidata":"https://www.wikidata.org/wiki/Q187432","display_name":"Scripting language","level":2,"score":0.705379843711853},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.5576015710830688},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.5389633178710938},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5365604758262634},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.47710520029067993},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.44798970222473145},{"id":"https://openalex.org/C154690210","wikidata":"https://www.wikidata.org/wiki/Q1668499","display_name":"Rewriting","level":2,"score":0.4206565320491791},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4159350097179413},{"id":"https://openalex.org/C202477664","wikidata":"https://www.wikidata.org/wiki/Q1352449","display_name":"Client-side","level":2,"score":0.4132028818130493},{"id":"https://openalex.org/C59241245","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Web application security","level":4,"score":0.2425304651260376},{"id":"https://openalex.org/C79373723","wikidata":"https://www.wikidata.org/wiki/Q386275","display_name":"Web development","level":3,"score":0.22299465537071228},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.20967978239059448}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ntms.2011.5720649","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms.2011.5720649","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2011 4th IFIP International Conference on New Technologies, Mobility and Security","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7799999713897705,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W1222699389","https://openalex.org/W1491237615","https://openalex.org/W1527571395","https://openalex.org/W1538001410","https://openalex.org/W1546773937","https://openalex.org/W1970867218","https://openalex.org/W1980558234","https://openalex.org/W2000026728","https://openalex.org/W2044675702","https://openalex.org/W2084641398","https://openalex.org/W2118315370","https://openalex.org/W2119156602","https://openalex.org/W2146519005","https://openalex.org/W4244284176","https://openalex.org/W6627779323","https://openalex.org/W6629287744","https://openalex.org/W6632499521","https://openalex.org/W6671777941"],"related_works":["https://openalex.org/W2571973613","https://openalex.org/W2609132699","https://openalex.org/W2283233106","https://openalex.org/W4296272594","https://openalex.org/W2104452318","https://openalex.org/W3197726148","https://openalex.org/W2900526031","https://openalex.org/W109909280","https://openalex.org/W4386387815","https://openalex.org/W2246375780"],"abstract_inverted_index":{"Ensuring":[0],"users":[1],"with":[2,55],"a":[3,9,64,92,176,183],"safe":[4],"web":[5,149],"experience":[6],"has":[7],"become":[8],"critical":[10],"problem":[11,57],"recently":[12],"as":[13,36,156],"fraud":[14],"and":[15,41,66,108,126],"privacy":[16],"infringement":[17],"on":[18,97],"the":[19,56,84,88],"Internet":[20],"are":[21,44],"becoming":[22],"current.":[23],"Web-scripting-based":[24],"malware":[25,141,163,167],"is":[26,123,173],"also":[27],"intensively":[28],"used":[29],"to":[30,62,72,104,132,136,148,181],"carry":[31,73],"out":[32,74],"longer-term":[33],"exploitation":[34],"such":[35,48,155],"XSS":[37],"worms":[38],"or":[39,158,166],"botnets,":[40],"server-side":[42],"countermeasures":[43],"often":[45],"ineffective":[46],"against":[47,186],"threats":[49],"while":[50],"client-side":[51],"ones":[52],"seldom":[53],"deal":[54],"of":[58,76,86],"obfuscation.":[59],"In":[60,79],"order":[61,135],"provide":[63,182],"sounder":[65],"more":[67],"complete":[68],"analysis,":[69],"we":[70,82,118,130],"propose":[71],"deobfuscation":[75,89],"web-scripting-language-based":[77],"malware.":[78,189],"this":[80,122],"paper,":[81],"study":[83],"possibility":[85],"automating":[87],"process":[90],"using":[91],"term":[93],"rewriting":[94],"system":[95],"based":[96],"automated":[98],"deduction.":[99],"Such":[100],"static":[101,164],"approach":[102,144],"intends":[103],"evade":[105],"anti-analysis":[106],"techniques":[107],"unknown":[109],"obfuscation":[110],"schemes.":[111],"With":[112],"some":[113],"preliminary":[114],"experiments":[115],"in":[116,134,175],"JavaScript,":[117],"show":[119],"evidence":[120],"that":[121,179],"actually":[124],"possible":[125],"highlight":[127],"several":[128],"challenges":[129],"need":[131],"tackle":[133],"implement":[137],"an":[138],"effective":[139],"script-based":[140,162],"deobfuscator.":[142],"This":[143,171],"can":[145],"be":[146],"generalized":[147],"scripting":[150],"languages":[151],"other":[152],"than":[153],"JavaScript":[154],"ActionScript":[157],"VBScript.":[159],"Applications":[160],"encompass":[161],"analysis":[165],"distribution":[168],"website":[169],"crawling.":[170],"paper":[172],"included":[174],"wider":[177],"project":[178],"aims":[180],"client-based":[184],"defense":[185],"Web":[187],"2.0":[188]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2020,"cited_by_count":2},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":5},{"year":2012,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}