JABBERWOCK: A Tool for WebAssembly Dataset Generation towards Malicious Website Detection

Machine Learning is often used for malicious site detection, but an approach incorporating WebAssembly (WASM) as a feature has not been explored due to a limited number of samples, to the best of our knowledge. In this paper, we propose JABBERWOCK, a tool to generate WASM datasets in a pseudo fashion via JavaScript. Loosely speaking, JABBERWOCK automatically gathers JavaScript code in the real world, converts them into WASM, and then outputs vectors of the WASM as samples for malicious website detection. We also conduct experimental evaluations of JABBERWOCK in terms of the processing time for dataset generation and comparison of the generated samples with actual WASM samples gathered from the Internet. Regarding the processing time, we show that JABBERWOCK can construct a dataset in 4.5 seconds per sample for any number of samples. Next, comparing 4299 samples output by JABBERWOCK with 348 gathered WASM samples, we believe that the generated samples by JABBERWOCK are similar to those in the real world. We believe that a model trained with the generated datasets by JABBERWOCK can detect malicious websites accurately.