IEEE Xplore - Login

Cart | Sitemap | Help

Login


	BROWSE	SEARCH	IEEE XPLORE GUIDE	SUPPORT


Article Information

Detecting malicious JavaScript code in Mozilla Hallaraker, O.; Vigna, G. Engineering of Complex Computer Systems, 2005. ICECCS 2005. Proceedings. 10th IEEE International Conference on Volume , Issue , 16-20 June 2005 Page(s): 85 - 94 Digital Object Identifier 10.1109/ICECCS.2005.35 Summary: The JavaScript language is used to enhance the client-side display of web pages. JavaScript code is downloaded into browsers and executed on-the-fly by an embedded interpreter. Browsers provide sand-boxing mechanisms to prevent JavaScript code from compromising the security of the client's environment, but, unfortunately, a number of attacks exist that can be used to steal users' credentials (e.g., cross-site scripting attacks) and lure users into providing sensitive information to unauthorized parties (e.g., phishing attacks). We propose an approach to solve this problem that is based on monitoring JavaScript code execution and comparing the execution to high-level policies, to detect malicious code behavior. To achieve this goal it is necessary to provide a mechanism to audit the execution of JavaScript code. This is a difficult task, because of the close integration of JavaScript with complex browser applications, such as Mozilla. This paper presents the first existing implementation of an auditing system for JavaScript interpreters and discusses the pitfalls and lessons learned in developing the auditing mechanism. » View citation and abstract



IEEE Members

Log in by entering your IEEE Web Account Username and Password. IEEE Communications Society members: If you subscribe to the IEEE Electronic Periodicals Package or IEEE Electronic Periodicals Package Plus, you must access your subscription at www.comsoc.org.



Users at Subscribing Institutions

Check with your librarian, information professional, or system manager to determine if you need to log in. Please complete the online Technical Support Form if you need assistance.



Already Purchased This Article?

Select the Purchase History link to access the document. You will have 5 Days after purchase to access the Full Text PDF. Please complete the online Technical Support Form if you need assistance.



Guests

• Search and access Abstract records free of charge • Register for table of contents alerts • Purchase Full Text PDF documents » Learn more about subscription options or how to become an IEEE Member.

You are not logged in.

Username

Password

» Forgot your password?

Please remember to log out when you have finished your session.

You must log in to access:
• Advanced or Author Search
• CrossRef Search
• AbstractPlus Records
• Full Text PDF
• Full Text HTML

Access this document

» Buy this document now

» Learn more about

subscription options

» Learn more about

purchasing articles

and standards

Learn more about IEEE Subscriptions

Help Contact Us Privacy & Security IEEE.org