论文部分内容阅读
There are a large number of extensions with many users in Google Chrome,which greatly enriches the functionalities of Chrome.However,due to inadequate security auditing,vulner-able updating mechanisms and time-delayed maintenance of Chrome Web Store,the store becomes a platform for attackers to distribute malicious extensions.Existing static analysis methods can hardly detect obfuscated codes and dynamic codes injected by extensions,while dynamic detection methods have low coverage due to the need to meet various constraints when extensions are being executed.We propose a method to analyze Chrome exten-sion behaviors dynamically based on direct execution of JavaScript(JS).The core idea of this method is to convert the analysis of the whole extension into the analysis of each JS in the extension,bypassing the constraints(e.g.language,region,URL)of the extension itself,and improving the coverage of detection.The analysis of more than 44 000 extensions showed that the method can effectively identify predefined behaviors.Among them,20 extensions had access to malicious domains,1 113 ex-tensions injected advertisements and 381 extensions collected users'passwords or cookies.At the same time,the number of URL requests obtained from this method is 177 893,which is 52.44％more than that from traditional dynamic analysis method.