NoCrypto: A Web Mining Behavior Detection Method Based on RGB Images
摘要
In recent years, there has been a growing prevalence of mining web pages using the new web technology of WebAssembly (WASM), resulting in the unauthorized exploitation of user resources. However, existing detection methods have shown limited ability to counter obfuscation techniques and have exhibited low detection efficiency. To address these issues, this paper proposes a novel static detection method based on the visualization of WASM modules. The proposed method involves instantiating the binary files of the WASM mining operations within web pages. These binary files are then combined with the information of local entropy and global entropy, resulting in the visualization of RGB images. Compared to grayscale images, RGB images retain more of the original file information. After training and learning the image features using a convolutional neural network (CNN), the model achieves an impressive accuracy rate of 99.18% when tested on real-world web pages. This accuracy is approximately 2% higher than that of existing visualization-based detection methods. Moreover, the model exhibits a shorter execution time. The proposed NoCrypto method demonstrates quick execution speed and accurate detection.