Malicious javascript detection based on abstract syntax trees (AST) and deep machine learning (DML)

A method for assessing a cybersecurity risk of a software object, the method comprising:

• generating, at a first compute device and for a software object, an abstract syntax tree (AST);
• determining that the AST is insufficient to identify, to a specified confidence level, a cybersecurity risk of the software object;
• determining that the cybersecurity risk of the software object cannot be determined based on previous cybersecurity risk classifications of other software objects;
• sending a signal to a second compute device, in response to determining that the AST is insufficient to identify the cybersecurity risk of the software object and determining that the cybersecurity risk of the software object cannot be determined based on the previous cybersecurity risk classifications, for gCNN-based generation of a set of features for the AST;
• and
• receiving, from the second compute device, a signal representing a probability of maliciousness of the software object that was calculated by the gCNN and based on the set of features for the AST.

A system for assessing a cybersecurity risk of a software object, the system comprising:

• a first compute device including a processor and a memory operably coupled to the processor of the first compute device, the memory of the first compute device storing processor-executable instructions to:
• generate an abstract syntax tree (AST) for a software object,
• determine that the AST is insufficient to identify, to a specified confidence level, a cybersecurity risk of the software object,
• determine that the cybersecurity risk of the software object cannot be determined based on previous cybersecurity risk classifications of other objects,
• send a first signal including a representation of the AST, in response to determining that the AST is insufficient to identify the cybersecurity risk of the software object and determining that the cybersecurity risk of the software object cannot be determined based on the previous cybersecurity risk classifications, and
• receive a signal representing a probability of maliciousness of the software object;
• and
• a second compute device including a processor and a memory operably coupled to the processor of the second compute device, the memory of the second compute device storing processor-executable instructions to:
• receive the first signal;
• generate, in response to receiving the first signal and based on the AST and a graph convolutional neural network (gCNN), a set of features for the AST;
• generate, based on the set of features and the gCNN, a probability of maliciousness of the software object;
• and
• send the signal representing the probability of maliciousness of the software object to the first compute device.