Find research datasets worth reusing
Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.
29
datasets available to search
ShareScore release 0.7.1
Dataset results
29 results for “javascript”
DrAsync: Identifying and Visualizing Anti-Patterns inAsynchronous JavaScript [Anonymous Experimental Data]
<p>////////////////////////////////////<br> //</p> <p>This directory contains the raw data used to compute aggregate numbers in the paper.<br> There are five files, and 2 subdirectories:</p> <p>(1) apply_run_times: has the raw execution times of various calls to apply throughout vuepress' tests;</p> <p>(2) cpdir_run_times: has the raw execution times of calling cpDir on a large directory as part of the cpDir case study;</p> <p>(3) eleventy_test_executions: contains 50 run times x 2 (before, after refactoring) for eleventy's test suite;</p> <p>(4) promise_resolve_then_case_study: contains execution times for the code fragment from strapi's evaluate function;</p> <p>(5) vuepress_test_executions: contains 50 run times x 2 (before, after refactoring) for vuepress' test suite.</p> <p>For the subdirectories:</p> <p>(1) DynamicAndExecutedAntiPatterns: for each of 20 subject applications x for each of 8 anti-patterns, contains the number<br> of static occurences of anti-patterns which are executed, as well as how often.</p> <p>(2) StaticAntiPatterns: for each of 20 subject applications x for each of 8 anti-patterns, contains the number of static<br> occurrences of the anti-pattern. We further filtered this by discounting anti-patterns appearing<br> in test, generated, build, etc. directories with a separate command.</p> <p>////////////////////////////////////<br> //</p> <p>CodeQL queries for the anti-patterns are given in supplemental material (available on the submission form). <br> We will make the code for the visualization tool available as part of the artifact submission process if this paper is accepted.</p>
Blocking JavaScript without Breaking the Web: An Empirical Investigation
<p>Anonymous</p>
Artifacts for the ISSTA 2023 Paper: An Empirical Study on the Effects of Obfuscation on Static Machine Learning-based Malicious JavaScript Detectors
<p>An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors</p> <p>This repository contains the evaluation script and the corresponding data of the ISSTA'23 paper "An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors".</p> <p>Abstract</p> <p>Machine learning is increasingly being applied to malicious JavaScript detection in response to the growing number of Web attacks and the attendant costly manual identification. In practice, to hide their malicious behaviors or protect intellectual copyrights, both malicious and benign scripts tend to obfuscate their own code before uploading. While obfuscation is beneficial, it also introduces some additional code features (e.g., dead code) into the code. When machine learning is employed to learn a malicious JavaScript detector, these additional features can affect the model to make it less effective. However, there is still a lack of clear understanding of how robust existing machine learning-based detectors are on different obfuscators.</p> <p>In this paper, we conduct the first empirical study to figure out how obfuscation affects machine learning detectors based on static features. Through the results, we observe several findings: 1) Obfuscation has a significant impact on the effectiveness of detectors, causing an increase both in false negative rate (FNR) and false positive rate (FPR), and the bias of obfuscation in the training set induces detectors to detect obfuscation rather than malicious behaviors. 2) The common measures such as improving the quality of the training set by adding relevant obfuscated samples and leveraging state-of-the-art deep learning models can not work well. 3) The root cause of obfuscation effects on these detectors is that feature spaces they use can only reflect shallow differences in code, not about the nature of benign and malicious, which can be easily affected by the differences brought by obfuscation. 4) Obfuscation has a similar effect on realistic detectors in VirusTotal, indicating<br>that this is a common real-world problem.</p> <p>Getting Started</p> <p>Requirements</p> <pre>install python3 version 3.9.12 pip3 install -r requirements.txt install nodejs install npm npm install escodegen npm install esprima</pre> <p>Step 1: Generating PDGs for JStap</p> <p><code>cd detectors/jstap/pdg_generation</code></p> <p><code>python generate_PDGs.py</code></p> <p>Step 2: Getting the results for RQ1: What Impact Does Obfuscation Have on Static Machine Learning Malicious JavaScript Detectors?</p> <p><code>cd RQ1/</code></p> <p>1. Detectors Performance on Obfuscated Samples.</p> <p>To train the models:</p> <p><code>python RQ1_1_train.py</code></p> <p>To get the results:</p> <p><code>python RQ1_1_test.py</code></p> <p>2. Different Machine Learning Algorithms.</p> <p>To train the models:</p> <p><code>python RQ1_2_train.py</code></p> <p>To get the results:</p> <p><code>python RQ1_2_test.py</code></p> <p>3. Biased Training Sets</p> <p>To train the models:</p> <p><code>python RQ1_3_train.py</code></p> <p>To get the results:</p> <p><code>python RQ1_3_test.py</code></p> <p>All the trained models will be stored in RQ1/models/.</p> <p>All the results will be stored in RQ2/results/.</p> <p>Step 3: Getting the results for RQ2: Are the Common Measures to Mitigate the Impact of Obfuscation Effective?</p> <p><code>cd RQ2/</code></p> <p>1. Training and Testing Detectors on Samples with Same Types of Obfuscation.</p> <p>To train the models:</p> <p><code>python RQ2_1_train.py</code></p> <p>To get the results:</p> <p><code>python RQ2_1_test.py</code></p> <p>2. Training and Testing Detectors on Samples with Different Types of Obfuscation.</p> <p>If you follow the steps, the models is already trained.</p> <p>To get the results:</p> <p><code>python RQ2_2_test.py</code></p> <p>3. BERT Variants.</p> <p>To get the results:</p> <p><code>python RQ2_3.py</code></p> <p>All the trained models will be stored in RQ2/models/.</p> <p>All the results will be stored in RQ2/results/.</p> <p> </p> <p>Step 4: Getting the results for RQ3: What Is the Root Cause of Obfuscation Affecting Static Machine Learning Malicious JavaScript Detectors?</p> <p>To get the results of vectors visualization, top ten features, and distances between vectors sets:</p> <p><code>cd RQ3</code></p> <p><code>python visulization.py</code></p> <p>The figures of vectors visualization will be stored in RQ3/results/.</p> <p>Other results will be shown in the console.</p> <p> </p> <p>Step 5: Getting the results for RQ4: How Does Obfuscation Affect Real-world Static Malicious JavaScript Detectors?</p> <p>To get the results, submit the sample under the folder samples/ to <a href="https://www.virustotal.com/gui/home/upload">VirusTotal</a> .</p> <p> </p> <p>Detailed Instructions</p> <p>detectors</p> <p>The detectors under the folder <code>detectors/</code> are the main projects to be evaluated in our paper, which are <strong>CUJO</strong>, <strong>ZOZZLE</strong>, <strong>JAST</strong>, and <strong>JSTAP</strong>.</p> <p>Detailed setup and usage instructions are described in <code>README.md</code> in the corresponding folder.</p> <p>samples</p> <p>The files under the folder <code>samples/</code> are the samples from a random tenth of our dataset used in our paper.</p> <p>Results can be obtained quickly using these samples. These results will not be exactly the same as in the paper, but they are similar.</p> <p>RQ1</p> <p>The code under folder <code>RQ1/</code> is to figure out how obfuscation affects these detectors.</p> <p><code>RQ1_1_train.py</code> is to train four detectors with unobfuscated samples.</p> <p><code>RQ1_1_test.py</code> tests these trained detectors with unobfuscated and obfuscated samples.</p> <p><code>RQ1_2_train.py</code> is to train the detector <strong>ZOZZLE</strong> that uses different machine learning algorithms.</p> <p><code>RQ1_2_test.py</code> tests these trained models with unobfuscated and obfuscated samples.</p> <p><code>RQ1_3_train.py</code> uses a training set with all unobfuscated benign samples and all obfuscated malicious samples, and a training set with all obfuscated benign samples and all unobfuscated malicious samples to train the detectors.</p> <p><code>RQ1_3_test.py</code> uses these detectors to detect unobfuscated benign samples, obfuscated benign samples, unobfuscated malicious samples, and obfuscated malicious samples, respectively.</p> <p>RQ2</p> <p>The code under folder <code>RQ2/</code> is to study the two measures to mitigate the impact of obfuscation effective or not.</p> <p><code>RQ2_1_train.py</code> uses obfuscated samples to train four detectors.</p> <p><code>RQ2_1_test.py</code> tests these detectors on the same type of obfuscated samples.</p> <p><code>RQ2_2_test.py</code> tests thest detectors on the different type of obfuscated samples.</p> <p><code>RQ2_3.py</code> uses the BERT variants to generate code representation of unobfuscated samples, trains the detector with these code representations, and tests the trained detectors with code representations of obfuscated samples.</p> <p>RQ3</p> <p>The code unser fodler <code>RQ3/</code> visualizes the vectors, extracts the ten most important features, and calculates the distance between different sets of vectors.</p> <p>RQ4</p> <p>There is no code related to RQ4 here because the actual operation of RQ4 is to submit the samples to <a href="https://www.virustotal.com/gui/home/upload">VirusTotal</a> .</p> <p> </p> <p>The whole dataset is available at <a href="https://drive.google.com/file/d/1a7pNUwzikiJyY9L7dIu53I6_MR0oDpgi/view?usp=sharing." target="_blank" rel="noopener">https://drive.google.com/file/d/1a7pNUwzikiJyY9L7dIu53I6_MR0oDpgi/view?usp=sharing.</a></p> <p> </p> <p>Cite this work</p> <pre>@inproceedings{staticanalysis, author = {Kunlun Ren, Qiang Weizhong, Yueming Wu, Yi Zhou, Deqing Zou, Hai Jin}, title = {An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors}, booktitle = {Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA'23)}, year = {2023} }</pre> <p> </p>
Inspecting JavaScript Vulnerability Mitigation Patches with Automated Fix Generation in Mind
<p>Software security has become a primary concern for both the industry and academia in the recent years.<br> As dependency on critical services provided by software systems grows globally, a potential security threat in such systems poses higher and higher risks (e.g. economical damage, threat to human life, criminal activity).</p> <p>Finding potential security vulnerabilities at the code level automatically is a very popular approach to aid security testing.<br> However, most of the methods based on machine learning and statistical models stop at listing potentially vulnerable code parts and leave their validation and mitigation to the developers.<br> Automatic program repair could fill this gap by automatically generating vulnerability mitigation code patches.<br> Nonetheless, it is still immature, especially in targeting security relevant fixes.</p> <p>In this work we try to establish a path towards automatic vulnerability fix generation techniques in the context of JavaScript programs.<br> We inspect 361 actual vulnerability mitigation patches collected from vulnerability databases and GitHub.<br> We found that vulnerability mitigation patches are not short on average and in many cases affect not just program code but test code as well.<br> These results point towards that a general automatic repair approach targeting all the different types of vulnerabilities is not feasible.<br> The analysis of the code properties and fix patterns for different vulnerability types might help in setting up a more realistic goal in the area of automatic JavaScript vulnerability repair.</p>
SNUTS.js: Sniffing Nasty Unit Test Smells in Javascript
<p>Manual Test Smell Detect</p>
SNUTS.js: Sniffing Nasty Unit Test Smells in Javascript Creators
<p>projects selected for the article</p>
JASFREE: Grammar-free Program Analysis for JavaScript Bytecode
Open the record for dataset details and reuse information.
Exploring the Security Awareness of the Python and JavaScript Open Source Communities
<p>Online appendix for "Exploring the Security Awareness of the Python and JavaScript Open Source Communities"</p>
On the (Un-)Adoption of JavaScript Front-end Frameworks
<p>DBR</p>
ScienceDex guides
Understand access before you commit
These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.
Allen Brain Atlas
Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.
Annotated Behaviour and Observability Dataset (ABODe)
ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.
DANDI Archive for NWB datasets
DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.
International Brain Laboratory public data
The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.
OpenNeuro
OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.