LightJD: A Lightweight JavaScript Drive-by Download Detection Framework

The proliferation of web applications has transformed the way individuals interact with information and services. Concurrently, the rise of the web has led to increased cyber security threats. As web applications are rendered on a user's browser, a malicious webpage can pose a serious threat to the user's device. Among the various attack methods, drive-by download stands out as a common tactic used by attackers to achieve their intrusion goals. By inserting malicious code into a webpage, attackers can execute code on the user's device without their awareness or consent. To tackle this issue, we propose LightJD, a lightweight framework designed to detect drive-by downloads by leveraging BERT, Bi-GRU, and Tree LSTM to extract features from both HTML tags and the associated JavaScript abstract syntax tree. Through comprehensive learning of these two features, LightJD is able to effectively detect and prevent drive-by downloads. To verify the effectiveness and practical utility of LightJD, we conducted five experiments. The results demonstrate that LightJD achieves a high F1 score of 0.995, with an average training time of 22.51 seconds and an average detection time of 17.51 milliseconds.