标题： 破解混淆：用于恶意JavaScript检测的集群感知图与大语言模型辅助恢复 显示英文标题

标题： Breaking Obfuscation: Cluster-Aware Graph with LLM-Aided Recovery for Malicious JavaScript Detection

摘要： 随着基于网络的应用程序和云服务的迅速扩展，恶意JavaScript代码持续对用户隐私、系统完整性和企业安全构成重大威胁。然而，由于复杂的代码混淆技术以及JavaScript固有的语言特性，特别是其嵌套闭包结构和语法灵活性，检测此类威胁仍然具有挑战性。在本工作中，我们提出了DeCoda，一种结合大型语言模型（LLM）去混淆和代码图学习的混合防御框架：(1) 我们首先构建一个复杂的提示学习管道，经过多阶段优化，其中LLM逐步从混淆输入中重建原始代码结构，然后生成规范化的抽象语法树（AST）表示；(2) 在JavaScript AST中，动态类型分散了语义相似的节点，而深度嵌套的函数则破坏了作用域捕获，引入了结构噪声和语义歧义。为了解决这些挑战，我们随后提出通过Cluster-wise Graph学习分层代码图表示，该方法协同整合图变压器网络、节点聚类和节点到聚类注意力机制，从而同时捕捉来自AST图的局部节点级语义和全局聚类引起的结构关系。实验结果表明，我们的方法在两个基准数据集上分别达到了94.64%和97.71%的F1分数，相对于最先进的基线方法分别提升了10.74%和13.85%。在固定FPR水平（0.0001、0.001、0.01）的假阳性控制评估中，我们的方法分别比表现最好的基线方法提高了4.82、5.91和2.53的TPR。这些结果突显了基于LLM的去混淆的有效性，并强调了在检测恶意代码时建模聚类级关系的重要性。 显示英文摘要

摘要： With the rapid expansion of web-based applications and cloud services, malicious JavaScript code continues to pose significant threats to user privacy, system integrity, and enterprise security. But, detecting such threats remains challenging due to sophisticated code obfuscation techniques and JavaScript's inherent language characteristics, particularly its nested closure structures and syntactic flexibility. In this work, we propose DeCoda, a hybrid defense framework that combines large language model (LLM)-based deobfuscation with code graph learning: (1) We first construct a sophisticated prompt-learning pipeline with multi-stage refinement, where the LLM progressively reconstructs the original code structure from obfuscated inputs and then generates normalized Abstract Syntax Tree (AST) representations; (2) In JavaScript ASTs, dynamic typing scatters semantically similar nodes while deeply nested functions fracture scope capturing, introducing structural noise and semantic ambiguity. To address these challenges, we then propose to learn hierarchical code graph representations via a Cluster-wise Graph that synergistically integrates graph transformer network, node clustering, and node-to-cluster attention to simultaneously capture both local node-level semantics and global cluster-induced structural relationships from AST graph. Experimental results demonstrate that our method achieves F1-scores of 94.64% and 97.71% on two benchmark datasets, demonstrating absolute improvements of 10.74% and 13.85% over state-of-the-art baselines. In false-positive control evaluation at fixed FPR levels (0.0001, 0.001, 0.01), our approach delivers 4.82, 5.91, and 2.53 higher TPR respectively compared to the best-performing baseline. These results highlight the effectiveness of LLM-based deobfuscation and underscore the importance of modeling cluster-level relationships in detecting malicious code.