Abstract:

Web applications are under the threat from malicious host problem just as native applications. How to ensure the core algorithm or main business process's security of Web applications in browser-side has become a serious problem needed to be solved. For the problem of low effectiveness to resist dynamic analysis and cumulative attack in present JavaScript code protection methods, a JavaScript code Protection based on Temporal Diversity (TDJSP) method was proposed. In order to resist cumulative attack, the method firstly made the JavaScript program obtain the diverse ability in runtime by building program's diversity set and obfuscating its branch space. And then, it detected features of abnormal execution environments such as debuggers and emulations to improve the difficulty of dynamic analysis. The theoretical analyses and experimental results show that the method improves the ability of JavaScript program against the converse analysis. And the space growth rate is 3.1 (superior to JScrambler3) while the delay time is in millisecond level. Hence, the proposed method can protect Web applications effectively without much overhead.

Key words: Web application, JavaScript code protection, cumulative attack, temporal diversity, code obfuscation

摘要：

Web应用同本地应用一样面临恶意主机威胁.如何确保暴露于用户主机中的Web应用核心算法或关键业务流程等重要信息的安全成为亟待解决的问题.针对现有JavaScript代码保护方法难以抵御动态分析且抗累积攻击效果差的问题,提出了一种具有时间多样性的JavaScript代码保护(TDJSP)方法.首先,通过程序多样化处理和路径空间模糊化,使JavaScript程序在执行时具有多样性效果,以有效抵御累积攻击;其次,检测调试器、模拟器等非正常执行环境的特征,并根据检测结果进行响应,增加攻击者进行动态分析的难度.理论分析和实验结果表明,JavaScript程序的抗逆向分析能力得到了提高,同时,其空间增长率约为3.1(优于JScrambler3),时间延迟为毫秒级.因此,该方法能够在不影响程序性能的前提下提升Web应用的安全性.

关键词: Web应用, JavaScript代码保护, 累积攻击, 时间多样性, 代码混淆