JSCoherence: detecting obfuscated malicious JavaScript via data

Abstract As a crucial component of websites, JavaScript is one of the most common attack payloads on malicious websites. Although many methods for detecting malicious JavaScript have been proposed, obfuscation techniques make it difficult for previous approaches to detect disguised malicious JavaScript effectively. To address this problem, we observe that malicious JavaScript often uses obfuscation to fragment key attack semantics and conceal them within data-dependent statements involving variable propagation. This observation suggests that data dependencies between variables can be leveraged to extract potentially malicious functional statements. Therefore, this paper proposes JSCoherence, a novel static detection method for obfuscated malicious JavaScript. Its core principle is to mine statement pairs with data dependencies through data-flow analysis, thereby reconnecting fragmented semantics and recovering locally coherent malicious behavior. Experiments show that JSCoherence achieves an F1 score of 99.77% on public datasets. On the Jfogs, JSObfu, and JavaScript-obfuscator obfuscated datasets, its F1 score consistently exceeds 95%, representing an improvement over the current advanced methods. In addition, JSCoherence provides interpretability by analyzing the semantics of representative data-dependent statement pairs, offering clear explanatory evidence for its detection decisions. Introduction Due to its extensive use in modern Web development, JavaScript has become ubiquitous, and nearly all interactive functionality on web pages depends on it. However, this ubiquity also makes JavaScript a primary target for attackers. Developing effective techniques for detecting malicious JavaScript has therefore become a critical task for ensuring Web security. Existing approaches to malicious JavaScript detection can be broadly divided into static and dynamic analysis. Dynamic analysis can reveal runtime behavior, but malicious scripts often hide the real payload inside one of many complex control-flow branches, greatly increasing path-exploration cost and making it difficult to trigger the malicious branch. In addition, dynamic analysis is resource-intensive and thus unsuitable for large-scale script screening. In contrast, static analysis offers full code coverage and higher detection efficiency. With the widespread adoption of machine learning, static analysis has gradually reduced its reliance on expert-defined heuristics and domain knowledge, further improving overall detection effectiveness. Early static detection methods for malicious JavaScript mainly rely on the abstract syntax tree (AST) for analysis (Curtsinger et al. 2011; Blanc et al. 2012; Kapravelos et al. 2013; Fass et al. 2018; Ndichu et al. 2019). AST provides a structured representation of both syntactic and behavioral information, using a standardized tree format that is much easier to parse and model than raw JavaScript code with its inherent complexity and variability. In traditional static approaches, a typical approach performs a depth-first traversal over AST nodes to generate a feature sequence composed of fields such as node type, value, and name. This sequence can capture the syntactic structure and a large portion of the semantic information of the code, and has therefore been widely adopted as a feature representation for malicious code detection. Figure 1 shows an example of data exfiltration and its corresponding AST sequence. Taking the variable xhr as an example, its initialization creates an XMLHttpRequest object, and the subsequent call to open configures the request. These two key statements appear adjacent in the AST sequence, forming a contiguous and semantically coherent local context. This property makes the script easier to detect. The methods based on AST sequences have demonstrated strong performance in detecting malicious JavaScript (Fang et al. 2020; Huang et al. 2021; Qin et al. 2023; Chen et al. 2025). However, as malicious JavaScript increasingly adopts obfuscation techniques to evade detection, methods based on AST sequences face serious challenges. Obfuscation techniques such as string splitting and concatenation, control-flow flattening, and dead-code injection often disrupt statements that originally carry strong contextual semantic relations, scattering their semantics across multiple statements while introducing irrelevant and redundant features, thereby breaking semantic continuity. In the obfuscated AST sequence shown in Fig. 1, obfuscation separates the semantics of the statements above, effectively diluting the semantic signals of malicious operations. At the same time, it introduces redundant features that significantly lengthen the sequence and weaken its representational power. As a result, by dispersing contextually related statements, obfuscation causes semantically relevant features to become scattered and diluted in the AST sequence, which can substantially degrade detection performance (Skolka et al. 2019; Sarker et al. 2020; Moog et al. 2021). It is worth noting that obfuscation is not unique to malicious JavaScript; benign scripts also frequently employ it to protect intellectual property. Moog et al. (2021) report that in the Alexa Top 10 K websites, more than 89.4% contain at least one obfuscated script. This highlights the urgent need for detection methods that are robust to obfuscation. To address the limitations of existing static methods for obfuscated JavaScript detection, recent studies have enriched AST-based representations by incorporating control-flow and data-flow information (Fass et al. 2019; Liang et al. 2019; Song et al. 2020; Fang et al. 2022; Liu et al. 2023). A common strategy is to construct or integrate control-flow graphs (CFGs), data-flow graphs (DFGs), or program dependence graphs (PDGs) alongside the AST, and then perform classification based on these graph-level representations. However, such representations remain relatively coarse-grained. They do not capture fine-grained semantic relationships effectively, while redundant features introduced by obfuscation are still mixed with informative ones, which weakens detection. As a result, the performance gains brought by these methods are often limited, whereas the computational cost increases substantially. More recent works (Yu et al. 2024; Wang et al. 2025; Zhang et al. 2025) further introduce large pretrained models into this setting, aiming to exploit their semantic reasoning ability to uncover latent relationships in these representations. However, the effectiveness of such methods still depends heavily on the capability of the underlying model. Since these models are typically trained on generic and non-obfuscated code corpora, they tend to produce more false positives and often generalize poorly to obfuscated scripts. To obtain a finer-grained representation and better capture malicious behavior, we shift the analysis from the whole-program level to the statement level. We further observe that, although obfuscation rewrites program structure and disperses semantics, it usually does not alter the core functionality of the program. For complex malicious behavior, the key data dependencies required for execution often remain preserved, making them an important clue for recovering hidden semantics. In the obfuscated code shown in Fig. 1, the two critical statements can still be reconnected through the variable _0x90ij, while the hidden malicious URL parameter can also be linked through the variable _0x12ab. By tracing such variable-level data dependencies, we can reconnect statements that have been separated by obfuscation and recover their original contextual semantics. Based on the observations above, we propose JSCoherence, a lightweight and interpretable static detection method for obfuscated malicious JavaScript. The core idea of JSCoherence is to leverage data dependencies to reconnect semantically related statements fragmented by obfuscation, thereby recovering locally coherent behavioral semantics. Specifically, JSCoherence first extracts data-dependent statement pairs (DDSPs), clusters semantically similar DDSPs, and represents each script by its distribution over DDSP clusters, which serves as script-level features for subsequent classification and interpretability analysis. The main contributions of this work are summarized as follows: - We reveal a key phenomenon in obfuscated malicious JavaScript: although obfuscation fragments the original malicious semantics in the AST and introduces abundant redundant syntactic structures, it usually does not completely disrupt the variable-level data propagation relationships that underlie malicious functionality. Therefore, data dependencies provide relatively stable cues for reconnecting fragmented statements and recovering local behavioral semantics under obfuscation. - Based on this observation, we propose DDSPs as a fine-grained modeling unit. Unlike existing methods that mainly model JavaScript using whole-program ASTs, DDSPs bring the detection granularity down to the statement level. By reconnecting obfuscation-separated data-dependent statements, DDSPs can restore local behavioral semantics and provide a finer-grained representation than AST-based approaches. - We introduce JSCoherence, a lightweight and interpretable static detection method based on DDSPs. JSCoherence constructs script-level cluster distribution representations over DDSPs and performs detection using a random forest classifier. Experimental results show that JSCoherence achieves an F1 score of 99.77% on public datasets and maintains over 95.08% F1 on obfuscated datasets, consistently outperforming other state-of-the-art methods. Furthermore, JSCoherence can provide semantic evidence by analyzing the centroid DDSP semantics of classification-critical clusters, enhancing the interpretability of the detection results. Related work Static analysis As a high-level syntactic abstraction, the AST provides a clear hierarchical structure and good generality, and has therefore been widely used in static detection of malicious JavaScript. Curtsinger et al. (2011) proposed ZOZZLE, which uses hierarchical AST features to identify malicious scripts. Huang et al. (2021) combined Bi-LSTM and TextCNN to model AST node embeddings and improve detection accuracy. Rozi et al. (2022) used graph2vec to generate AST semantic embeddings and combined them with XGBoost for malicious JavaScript detection. Qin et al. (2023) applied a neural machine translation model to recover the structure of obfuscated code and learn semantic template mappings to enhance the detection of obfuscated samples. Chen et al. (2025) compressed AST structures to reduce redundancy caused by obfuscation, enabling the model to capture more effective information and enhance detection accuracy. To improve robustness under obfuscation, several works explicitly incorporate control-flow and data-flow information into AST-based representations. Fass et al. (2019) proposed JStap, which augments the AST with control-flow and data-flow edges and uses a random forest for detection. Liang et al. (2019) used a deep neural network to extract syntactic and semantic features of ASTs and CFGs, which are then fused for classification. Song et al. (2020) traversed control and data dependencies starting from sensitive function nodes to extract malicious semantics. Fang et al. (2022) fed ASTs enriched with both data-flow and control-flow information into a graph neural network for feature learning. Liu et al. (2023) transformed ASTs and CFGs into graph and code-sequence structures, and combined logical and contextual features to classify. In recent years, LLMs have also been introduced into malicious code detection. Yu et al. (2024) leverages their semantic understanding ability to expand malicious corpora, normalize malicious functions written in different languages into JavaScript, and then uses PDGs to identify malicious code. Wang et al. (2025) proposes a framework that combines model-generated features with traditional classifiers. However, the performance of such approaches (Yu et al. 2024; Wang et al. 2025; Zhang et al. 2025; Guo et al. 2026) is highly dependent on the reasoning and code-understanding ability of the underlying pretrained backbone. Most publicly available models are trained on generic, non-obfuscated code and are not well adapted to obfuscated syntax or malicious logic, which limits their accuracy on heavily obfuscated scripts. In addition, their high computational cost restricts practical deployment on long scripts and in latency-sensitive real-time detection scenarios. Dynamic analysis Dynamic approaches typically execute JavaScript in a controlled or sandboxed environment to trigger potential malicious behaviors and extract runtime features. Ratanaworabhan et al. (2009) proposed Nozzle, which detects malicious JavaScript by analyzing executable objects on the heap. Rieck et al. (2010) introduced Cujo, which aggregates static and dynamic features and uses an SVM to detect drive-by-download attacks. Kim et al. (2012) presented JsSandbox, which hooks functions to collect debugging information and parameter values for identifying obfuscated malicious scripts. Kapravelos et al. (2013) proposed Revolver, which combines AST features with runtime behavior features to distinguish benign and malicious code. Al-Taharwa et al. (2015) introduced JSOD, which performs dynamic deobfuscation and execution to assess the maliciousness of obfuscated scripts. Wang et al. (2015) proposed JSDC, which fuses syntactic structure, sensitive function calls, and dynamic execution information for hybrid detection. Kim et al. (2017) presented J-FORCE, which explores multiple potential execution paths by mutating branch predicates in order to uncover hidden malicious behaviors. Pantelaios and Kapravelos (2024) proposed FV8, a dynamic analysis approach built on a modified V8 engine. By selectively forcing the execution of operations related to conditional dynamic code injection, it improves code coverage and exposes malicious behaviors that would otherwise remain hidden due to evasion techniques. Huang et al. (2024) proposed DONAPI for malicious npm package detection. It centers on sensitive operations and behavioral sequences, and combines static and dynamic analysis to identify malicious packages and automatically map them to their corresponding behavior categories. As shown in Table 1, existing malicious JavaScript detection methods differ significantly in terms of analysis type, adopted features, detection mechanism, and methodological limitations. Dynamic analysis methods can directly observe runtime API calls and execution traces, which helps capture real execution behaviors. However, such methods usually rely on specific browsers or sandbox environments. Under complex path conditions, user-interaction triggers, delayed execution, or environment-evasion scenarios, hidden malicious branches may be difficult to trigger reliably, and the analysis overhead is also relatively high. In contrast, static analysis methods have higher detection efficiency and are more suitable for large-scale script analysis, but their feature representations are easily affected by obfuscation techniques. Specifically, AST-based methods mainly rely on syntactic structure features. When obfuscation techniques introduce a large number of redundant nodes, split expressions, or disrupt contextual semantics, features related to malicious behaviors may be diluted. Methods that incorporate control-flow or data-flow information can capture richer program dependencies, but they still typically model the program at the level of global, whole-program representations. As a result, they may have difficulty sufficiently separating effective malicious semantics from redundant semantics introduced by obfuscation, and their interpretability is usually relatively coarse-grained. In recent years, LLM-assisted or knowledge-driven methods have shown strong semantic reasoning capabilities in malicious code detection. However, their detection effectiveness often depends on prompt design, external knowledge bases, and model capability, and their inference cost is also relatively high. Compared with the above methods, JSCoherence models JavaScript using DDSPs as the basic modeling units. It reconnects predecessor and successor statements fragmented by obfuscation through variable-level data dependencies, thereby recovering locally coherent behavioral semantics. Furthermore, JSCoherence uses a cluster distribution to represent script-level features, reducing the influence of redundant DDSPs introduced by obfuscation on the overall detection result. Compared with end-to-end deep learning models, the detection process of JSCoherence is more lightweight, and it can provide more intuitive semantic explanations through representative DDSPs. Therefore, JSCoherence provides a lightweight, interpretable, and obfuscation-robust static detection method for detecting obfuscated malicious JavaScript. Methodology In this section, we introduce the design of our approach, JSCoherence. Overview We define the DDSP as a pair of statements in a JavaScript program that are connected by a data dependency. DDSPs within a script are defined as follows: where S denotes the set of all statements, and dep(\(s_1, s_2\)) indicates the existence of a data dependency from \(s_1\) to \(s_2\). DDSPs characterize local operations centered on the same variable. JSCoherence extracts DDSPs to reconstruct semantically coherent local representations from scattered statements, and then combines unsupervised clustering with feature-importance analysis based on a random forest classifier. In this way, DDSPs lacking substantive semantics and exhibiting low discriminability are aggregated into low-importance clusters and effectively down-weighted, thereby improving the detection of obfuscated malicious JavaScript. The overall framework, shown in Fig. 2, mainly consists of three stages: DDSP-based feature extraction. We first perform static data-flow analysis to identify all DDSPs in the code, and then use their associated AST features to construct semantically coherent feature sequences. Clustering-based vectorization. For all DDSPs, we apply K-Means clustering to group semantically similar DDSPs into clusters. Each sample is then represented by its DDSP distribution over these clusters, yielding a vectorized representation. Classification. A random forest classifier is used for training and testing. Based on the feature importance of the trained model, the central DDSPs of high-importance clusters are analyzed to reveal the differences in code behaviors between benign and malicious samples regarding variable-level data dependencies. DDSP-based feature extraction To identify data dependencies in JavaScript, we use the open-access tool Js-transformations (Js-transformations 2021), which parses code into an AST with Esprima (2019) and annotates variable nodes involved in data dependencies. To extract the syntactic unit types and values of AST nodes contained in each code statement, we further identify statement-level AST subtrees. Specifically, we define a basic statement as the smallest subtree rooted at a node of type Statement or Declaration, such that no other Statement or Declaration node appears within that subtree. We then perform a depth-first traversal on each such subtree and use the resulting sequence of types and values as the feature representation of the statement, which is further used to extract DDSP features. As illustrated by the green dashed arrows in Fig. 3, there are four data dependencies in the original code. For the first two dependencies, the resulting DDSP feature sequences are almost identical to the corresponding local subsequences in the AST sequence, as indicated in red and blue by marker (1) in the figure. For the latter two, however, the DDSP feature sequences directly connect AST features that are far apart in the AST sequence but semantically related, as shown in purple and brown by marker (4). In the original AST sequence, some statements with data dependencies have relatively scattered semantics because their corresponding AST subtree positions are far apart, as in the function declaration–call dependency marked by (4). This issue becomes more pronounced when the function body is large. In contrast, DDSP-based feature extraction can tightly couple features of semantically related statements that are structurally far separated in the AST, yielding locally semantically coherent representations of code behavior that are superior to AST sequences in terms of semantic continuity. In the obfuscated code shown in Fig. 4, DDSP-based feature extraction can reconnect the AST features of semantically related statements that have been separated by obfuscation. Rather than directly removing redundant features injected by the obfuscation, our method partitions AST features at statement granularity, which helps separate effective and informative features from redundant ones to some extent. Since redundant DDSPs are only weakly related to the core functionality and lack substantive behavior, their associated features are assigned low importance by the classifier during training, thereby reducing their impact on detection. Compared with traditional approaches that feed both effective and redundant features to the model as a whole, such as methods based on full AST or PDG representations, DDSP-based feature sequences offer stronger semantic coherence, finer granularity, and higher information density. They highlight key code semantics in variable operations and mitigate the dilution of effective information by redundant features, thereby improving the robustness of malicious code detection under obfuscation. Clustering-based vectorization Although DDSPs alleviate semantic dispersion to some extent, the extracted DDSPs still contain redundancies, and it is unclear which ones are redundant. These redundant DDSPs do not carry malicious semantics and usually correspond to benign, non-functional code statements. If they are used indiscriminately together with distinguishing and informative features during model training, they may weaken the classifier’s ability to detect malicious JavaScript and even lead to misclassification. Therefore, the core idea of this subsection is to use unsupervised clustering to group semantically similar DDSPs into the same cluster, so that low-information, highly repetitive, and semantically simple DDSPs introduced by obfuscation can be separated from DDSPs that represent specific meaningful behavioral semantics. Redundant DDSPs tend to self-aggregate into stable but weakly discriminative clusters, allowing the model in subsequent training to focus on highly discriminative clusters to suppress the influence of redundant features on the classification results. We first obtain word embeddings for DDSPs using FastText (2024). As a shallow text embedding model, FastText offers higher training efficiency than traditional Word2Vec and can effectively handle out-of-vocabulary words and subword information, making it particularly suitable for complex obfuscated code. For each DDSP, we apply average pooling over the embeddings of all words it contains to obtain a fixed-dimensional vector representation. Next, we apply the unsupervised K-Means clustering algorithm to all DDSPs in the training set. K-Means is simple, efficient, and easily scalable, making it well-suited for large-scale clustering. Through clustering, DDSPs that represent specific behavioral semantics can be distinguished from redundant DDSPs that lack substantive behavioral semantics. These form, respectively, important clusters with strong discriminative power and redundant clusters. Since redundant clusters exhibit similar distributions in benign and malicious samples and lack discriminative capability, the classifier automatically assigns them lower importance during training, thereby mitigating their negative impact on malicious code detection. Finally, we construct a vector representation for each sample based on the clustering results. During training, we perform K-Means clustering on all DDSPs from the training samples, grouping semantically similar DDSPs into the same cluster, and then compute, for each sample, the frequency distribution of its DDSPs over these clusters. Based on text similarity, each DDSP in a test sample is assigned to the nearest cluster obtained during training, and the DDSP distribution over clusters of each test sample serves as its vector representation. Concretely, if the clustering yields k clusters, each sample is represented as a length-k vector [\(P_1, P_2,..., P_k\)], where \(P_i\) denotes the proportion of DDSPs in the sample that fall into the i-th cluster. Since each cluster corresponds to a particular local variable operation pattern, this DDSP distribution characterizes the statistical footprint of the sample over these behavioral patterns and can be viewed as a high-level abstraction of its overall variable-level operation patterns. Classification To achieve efficient and interpretable detection, we adopt the random forest as the classification model. Compared with complex deep neural networks, traditional machine learning classifiers incur lower training and inference overhead, making them more suitable for large-scale static analysis. In addition, random forest provides a built-in mechanism for feature importance estimation. We use this to quantify the contribution of each cluster to the final decision, assign higher weight to highly discriminative clusters, and down-weight redundant clusters, thereby mitigating the impact of obfuscation on the classification results. Furthermore, we perform semantic analysis of the representative DDSPs at the centers of high-importance clusters, which provides interpretability for the classification decisions and helps compensate for the limited explainability of conventional deep learning methods. Experiments In this section, we first describe the datasets and experimental environment. We then present our strategy for selecting the key clustering parameter, namely the number of clusters K, and evaluate the detection performance of JSCoherence. Next, we demonstrate the interpretability of JSCoherence, analyze its runtime, and finally evaluate its cross-dataset generalization ability. Datasets and experimental environment Datasets. The datasets used in this work are collected from multiple public sources. Malicious samples are taken from the public malicious JavaScript datasets of Hynek Petrak (2024), Geeksonsecurity (2023) and MalwareBazaar (2026), while benign samples are collected from JavaScript scripts loaded by the top 10,000 websites ranked by Tranco (2025). Table 2 summarizes the detailed statistics. We note that some malicious samples were collected relatively long ago, and the obfuscation techniques they use may not fully reflect the threat posed by modern obfuscation. To increase the realism and difficulty of our experiments, we apply the popular obfuscation tools Jfogs (2018), Jsobfu (2025), and JavaScript-obfuscator (Javascript-Obfuscator 2025) to the original samples to generate obfuscated variants at controlled obfuscation levels. Jfogs primarily employs lightweight wrapper-function obfuscation. It replaces directly visible elements, such as identifiers, property names, and literals, with wrapper-function parameters, thereby hiding original function-call identifiers and constant representations. It also supports zero-width character encoding and reverse encoding, making literals more difficult to match at the source-code level. JSObfu focuses more on code-structure randomization and constant hiding. It rewrites string constants into runtime-evaluated expressions, such as character-code constructions, string concatenations, or anonymous-function return values, combined with scope-related obfuscation, function hoisting, anonymous-function wrapping, and multi-round iterative obfuscation, causing identical semantics to appear in different syntactic forms. In comparison, JavaScript-obfuscator provides more comprehensive obfuscation transformations. It covers several transformation types used by Jfogs and JSObfu, such as identifier renaming, literal and string transformation, string reconstruction, and property-access transformation, while further introducing more complex techniques, including string arrayification, string-index permutation, control-flow flattening, dead-code injection, and anti-analysis mechanisms such as self-defending and debug protection. Experimental environment. All experiments are conducted on a server running Ubuntu, equipped with an AMD EPYC 7302 16-Core Processor, two GeForce RTX 4090 Ti GPUs, and 256 GB of memory. The dataset is randomly split into training, validation, and test sets in an 8:1:1 ratio. Our method is implemented in Python. The embedding dimension for words in DDSPs is set to 100. K-Means clustering is implemented using the KMeans module in scikit-learn, where all parameters are kept at their default values except for the number of clusters K. The random forest classifier is also implemented using scikit-learn, with n_estimators set to 100 (that is, 100 decision trees), and all other parameters left at their default settings. Selection of the number of clusters K To determine the optimal number of clusters K for the K-Means algorithm, we first apply the elbow method on the training set to obtain a reasonable range of K, then select the final value according to the F1 score, the harmonic mean of precision and recall, on the validation set. The elbow method assesses clustering quality using the sum of squared errors (SSE), where a smaller SSE indicates that samples are closer to their respective cluster centers, implying better cohesion. As shown in Figs. 5 and 6, we plot the SSE and F1 score values corresponding to different values of K on different obfuscated datasets. The main observations are as follows: - SSE versus \(\varvec{K}\). For all datasets, SSE decreases monotonically as K increases, but the rate of decrease gradually diminishes and eventually stabilizes. On the original dataset, the curve begins to flatten when K reaches 50. For the Jfogs datasets, a similar trend appears after K reaches 60. For the other two datasets, a similar trend appears after K reaches 70. This suggests that further increasing K beyond these points yields very limited gains in clustering quality. - F1 score versus \(\varvec{K}\). On all datasets, the F1 score generally improves as K increases, and then exhibits only minor fluctuations once it approaches a near-optimal region. Specifically, on the original dataset, the F1 score is already close to its maximum at K=52. For the other datasets, near-optimal performance is achieved at K=62, K=73 and K=74, respectively. Combining the trends of SSE and F1, we observe that the final K on the obfuscated datasets is larger than on the original dataset. This is because obfuscation introduces additional redundant features that require extra clusters to distinguish and separate them. Overall, JSCoherence maintains F1 scores above 95% across all datasets, demonstrating strong performance even under different obfuscators and highlighting its robust generalization. To further evaluate the impact of DDSP and clustering in JSCoherence, we conducted a comparative analysis using AST sequence, DDSP sequence, and JSCoherence across all datasets. For the AST sequence and DDSP sequence, we employed a random forest classifier with n-gram features (n=1,2,3,4) and term frequency–inverse document frequency representations. The results are summarized in Table 3. Across all datasets, introducing DDSP consistently improves both accuracy and F1 compared to the AST baseline. On the original and Jfogs datasets, DDSP increases accuracy and F1 by 7.39–8.93%. On the more heavily obfuscated JSObfu and JavaScript-obfuscator datasets, DDSP yields substantial gains, with accuracy improving by 11.92% and 16.66%, and F1 increasing by 18.56% and 27.80%, respectively, demonstrating its ability to extract continuous semantic patterns and enhance feature robustness even under complex obfuscation. JSCoherence further improves performance through clustering. On the Original and Jfogs datasets, the gains are small but stable. In more challenging obfuscation scenarios, clustering provides significant improvements: for JSObfu, JSCoherence increases accuracy and F1 by 6.77% and 7.61% over DDSP; for the JavaScript-obfuscator dataset, accuracy and F1 are further improved by 6.95% and 8.07%. These results indicate that clustering not only stabilizes feature representations but also enhances generalization across diverse obfuscation techniques. Overall, the experiments clearly show that DDSP effectively captures robust, discriminative features under obfuscation, while the clustering in JSCoherence further strengthens representation and generalization, complementing DDSP to achieve consistently high detection performance. Comparison with existing detection methods We evaluate the detection performance of JSCoherence by comparing it against other representative static methods, Huang et al. (2021), Fang et al. (2022), and Ren et al. (2023). All methods rely on AST- or PDG-based feature representations for malicious JavaScript detection. PDG_LLM takes PDG-based features generated by Js-transformations (2021) as input, with node information and edge relations encoded in a dictionary structure, and uses DeepSeek: DeepSeek-R1-Distill-Qwen-14B. github.com, deepseek-ai, DeepSeek-R1, (2025) for classification. During training, only the parameters of QLoRA and the classification head are updated. We use accuracy, precision, recall, and F1 score as evaluation metrics, and the results are reported in Table 4. On the original dataset, JSCoherence performs slightly better than the other methods. When obfuscation is weak, the AST already provides sufficiently discriminative semantic information, with little redundant noise, so the gap between methods remains small. On the Jfogs dataset, JSCoherence still holds an advantage. Compared with the original dataset, string-encoding obfuscation reduces the detection performance of all methods, but because the obfuscation strategy is relatively simple, the differences between methods are still limited. However, on the JSObfu and JavaScript-obfuscator datasets, the performance of JSContana and JStrong drops sharply. Compared with the original dataset, all of their metrics decrease by more than 19.01% and 13.63%, respectively. This suggests that, as obfuscation becomes more complex, directly using raw AST features, or simply enhancing them with control-flow and data-flow information, is no longer sufficient to effectively capture the key semantics of the code, and is highly susceptible to redundant features introduced by obfuscation. JSRevealer alleviates the aforementioned problems to some extent. JSRevealer partly alleviates this issue by constructing path-contexts (Alon et al. 2018) through data-flow analysis and extracting only nodes related to data dependencies. However, its features are built at the path-node level. While this helps reduce redundant information during feature extraction, it also makes it difficult to preserve complete code semantics, and important nodes may be missed. Fine-tuned LLM-based methods exhibit another type of limitation. Their performance depends heavily on the reasoning ability of the underlying pretrained models, while most existing open-source models are trained on general, non-obfuscated code corpora and lack targeted training on obfuscated syntax and malicious semantics. Fine-tuning on top of such backbones cannot fully close this gap. Bridging this gap usually requires parameter updating through retraining on a large corpus of obfuscated malicious code, which demands substantial data and considerable time; otherwise, performance tends to decline on obfuscated malicious samples. In contrast, JSCoherence mainly relies on DDSP to reconnect previously discrete and fragmented semantic information, making the code semantics more coherent and complete. It further uses clustering mechanisms to mitigate the interference from obfuscation noise. As a result, JSCoherence exhibits stronger stability and generalization ability under various obfuscation scenarios. In terms of F1, its performance drops by no more than 4.69% compared with the original dataset. JSCoherence also outperforms the strongest static baseline by at least 4.68% in accuracy and 4.67% in F1, and exceeds the LLM-based methods by 3.94% and 4.10%, respectively. These results indicate that DDSP extraction and clustering are not merely combined, but rather form an effective complement in both semantic reconstruction and noise suppression, thereby significantly improving the model’s robustness and detection performance in complex obfuscation scenarios. Overall, these experiments confirm that JSCoherence consistently holds an advantage across all datasets. By modeling code at the statement level with DDSP, JSCoherence restores the semantic dependencies disrupted by obfuscation. Combined with clustering, it can better separate useful features from redundant ones and reduce the impact of obfuscation noise at the representation level. In short, JSCoherence provides an effective solution for static malicious JavaScript detection under complex obfuscation. DDSP-based interpretability analysis The trained random forest assigns an importance score to each cluster, which is treated as a feature. Figure 7 presents the average per-sample DDSP distributions across clusters for both classes. Although such cluster-level averages cannot fully capture the internal DDSP distribution of individual samples, they reveal, at an aggregate level, how the two classes differ in their data-flow behavior patterns. The results show that several high-importance clusters exhibit clear separation between benign and malicious samples. For example, in clusters 3, 35, and 38, the average proportion of DDSPs is noticeably higher in benign scripts, indicating that DDSPs in these clusters are more characteristic of normal functionality in benign JavaScript. In contrast, clusters 18, 24, and 40 have higher average proportions in malicious samples, suggesting that DDSPs in these clusters are more likely associated with malicious behaviors. These high-importance clusters form key decision cues for the classifier. At the same time, we also observe that some clusters exhibit noticeable differences in average proportions between benign and malicious samples, yet still receive low feature-importance scores in the random forest. On the one hand, although the class-wise means differ, the per-sample values for these clusters overlap heavily across classes, making it difficult to derive a stable, low-error decision boundary from them alone; their discriminative power as individual features is therefore limited. On the other hand, such clusters mainly act as supporting features whose effect emerges only in combination with several high-importance clusters. Under the split-gain-based feature-importance measure used by random forests, their contribution is distributed and attenuated, leading to low marginal gains and consequently low overall importance scores. It is worth emphasizing that these class-wise average distributions over clusters only provide a coarse, population-level view of how benign and malicious samples differ in their DDSP allocations. They do not reflect the true DDSP distribution of any individual sample; in practice, the classifier makes decisions based on each sample’s own DDSP distribution vector. To further interpret the semantic basis of the model’s decisions, we analyze representative DDSPs from the top six clusters ranked by feature importance. For each such cluster, we select the DDSP closest to the cluster centroid and perform a manual semantic inspection. Representative examples are summarized in Table 5. Cluster 38 illustrates a standard function definition and export pattern in modular JavaScript code. Specifically, the code first defines a function using function and then exposes it as the public interface of a module. This pattern is widely used in CommonJS-based projects to encapsulate specific functionality and make it reusable across other files. Such code is commonly found in benign web applications, utility libraries, and front-end frameworks, where individual functions are packaged as reusable components. Cluster 3 reflects a typical conditional validation and branching pattern. In this case, the code first evaluates whether a value satisfies a certain condition, processes it accordingly, and then further checks additional conditions before determining the next execution path. This pattern is commonly used in engineering code that must handle multiple runtime scenarios robustly. Its primary purpose is to ensure that subsequent logic is selected appropriately based on the current state or intermediate results. Such structures are prevalent in benign scripts, particularly within utility frameworks, asynchronous processing pipelines, and stream-oriented data handling, where explicit validation and branching are integral to normal business logic. Cluster 35 represents a canonical module import and invocation pattern. More specifically, the code imports an external module using require, binds the imported interface to a local variable, and then immediately invokes it, for example, to execute a test. This pattern is characteristic of benign development workflows, where external libraries are imported and used through their exposed APIs. It is commonly observed in scenarios such as dependency reuse, unit-test construction, and modular function invocation, reflecting standard engineering practices. In contrast, cluster 18 captures a typical dynamic code execution pattern in malicious scripts. Specifically, the code uses new Function to dynamically construct a string-processing routine that restores strings interleaved with the delimiter #### into valid code, and then passes the recovered code to eval for execution. This pattern, in which strings are first concealed, then decoded at runtime, and finally executed dynamically, is commonly observed in malicious JavaScript and script loaders. Cluster 40 reflects the recovery of encoded numeric values into strings or code fragments. More specifically, the code first binds String.fromCharCode to the variable stringFromCharCode, and then uses this function to convert encoded numeric values back into Unicode characters. Such a pattern forms an important part of the malicious code string process through which numeric sequences are transformed into character sequences and eventually reconstructed as hidden strings or code fragments. It is frequently used in obfuscated malware to restore concealed content at runtime. Cluster 24 represents the behavior of writing binary content into a stream and then saving it to disk. In particular, the code first writes binary content into a stream object through Write, and then saves it to disk through SaveToFile. This pattern is commonly associated with payload reconstruction and delivery, as it directly supports the release of binary content onto the host system, often in executable form. Such code often appears in malicious scripts that rely on ADODB.Stream, and is frequently found in downloaders, droppers, Trojan installation scripts, and other payload delivery logic. In summary, DDSP leverages data dependencies to link consecutive statements, enabling the reconstruction of semantic chains often disrupted by obfuscation and effectively recovering hidden execution semantics for coherent program understanding. In benign code, DDSP reveals local behavioral patterns such as function definitions and exports, validation and branching, and module import and invocation. In contrast, malicious code frequently exhibits behaviors including dynamic execution, string decoding and reconstruction, and binary payload writing. Therefore, DDSP enables the analysis of statement-level local behaviors by capturing their semantic dependencies, allowing for the differentiation of benign and malicious activities and enhancing both code interpretability and detection effectiveness. Runtime comparison of different methods To evaluate the efficiency of JSCoherence in script-level detection of obfuscated malicious JavaScript, we report the average per-script runtime of different methods on the original, Jfogs, JSObfu, and JavaScript-obfuscator datasets. The runtime is measured across three stages: feature extraction and embedding, model training, and classification. The average script sizes are approximately 28 KB, 66 KB, 103 KB, and 283 KB, respectively. The results are summarized in Table 6. In the feature extraction and embedding stage, JSCoherence requires more time than JSContana and PDG_LLM, primarily due to the overhead of DDSP extraction and cluster-based distribution computation. These operations are more computationally intensive than standard AST or PDG feature extraction. The average feature extraction time per script for JSCoherence is approximately 0.04 s on the original dataset, increasing to 0.08 s, 0.17 s, and 0.40 s on the Jfogs, JSObfu, and JavaScript-obfuscator datasets, respectively. During model training and classification, JSCoherence exhibits minimal overhead, second only to JSRevealer. Across all datasets, its average training time per script remains below 0.37 s, and classification takes less than 1 ms. These times are significantly lower than those of methods based on deep neural networks or large language models, which require substantially longer training and inference. In practical detection scenarios, the per-script overhead is dominated by feature extraction and embedding, along with classification. For JSCoherence, the average detection times are approximately 0.04 s, 0.08 s, 0.17 s, and 0.40 s on the original, Jfogs, JSObfu, and JavaScript-obfuscator datasets, respectively, which are well within acceptable limits for real-world deployment. Compared to deep learning or LLM-based approaches, JSCoherence reduces deployment and update costs while maintaining robust detection performance. Overall, these results demonstrate that JSCoherence achieves strong efficiency and scalability for script-level detection. Cross-dataset generalization evaluation To evaluate whether JSCoherence can capture generalizable malicious semantics rather than learn noise features introduced by specific obfuscation tools, we conduct a small-scale cross-dataset evaluation. Since JavaScript-obfuscator provides more comprehensive and complex obfuscation strategies, covering several transformation types used by Jfogs and JSObfu while further introducing stronger transformations, we use its obfuscated samples as the target test set. This setting provides a more challenging scenario for evaluating the model’s generalization ability when facing unseen obfuscation techniques. Correspondingly, Jfogs-obfuscated samples, JSObfu-obfuscated samples, and their combination are used as training sets. To construct a representative cross-dataset evaluation scenario, we adopt stratified random sampling, selecting 10% of the original scripts from both benign and malicious samples in the original dataset and generating their corresponding obfuscated versions for the experiments. The dataset partitioning, model training, and testing procedures are kept consistent with the preceding experiments. As shown in Table 7, as the complexity and diversity of obfuscation techniques in the training set increase, the model’s generalization performance on the JavaScript-obfuscator test set improves continuously. Specifically, when only Jfogs-obfuscated samples are used for training, the model achieves an accuracy of 85.75% and an F1 score of 85.12%. Since Jfogs mainly includes relatively lightweight transformations such as identifier renaming and string obfuscation, its coverage of complex obfuscation patterns is limited. Therefore, the model is still affected by unseen obfuscation perturbations when facing samples generated by JavaScript-obfuscator. Nevertheless, this result is still close to the median level among the mainstream methods evaluated on the JavaScript-obfuscator dataset in Table 4, indicating that even when the training set contains only relatively lightweight obfuscated samples, JSCoherence can still capture data-dependent behavioral features with a certain degree of generalization. When JSObfu samples with a higher degree of obfuscation are used for training, the model’s accuracy and F1 score increase to 90.87% and 90.41%, respectively, indicating that more complex obfuscated training samples help the model learn more robust behavioral representations. Notably, this result is already close to the best-performing results among the mainstream methods evaluated on the JavaScript-obfuscator dataset in Table 4, demonstrating that the DDSP representation still maintains good robustness in cross-obfuscation-dataset scenarios. Furthermore, when the combination of Jfogs and JSObfu samples is used for training, JSCoherence achieves the best performance, with an accuracy of 92.25% and an F1 score of 91.42%. This result indicates that the diversity of obfuscated samples in the training set helps the model learn a more robust DDSP cluster distribution, thereby improving its adaptability to unseen obfuscation techniques. In summary, the above trend shows that the DDSP-based representation of JSCoherence can capture relatively stable data-dependent behavioral semantics under different obfuscation transformations. This is because DDSP does not directly rely on the surface syntactic form of the overall obfuscated AST, but instead reconnects statements fragmented by obfuscation through variable-level data dependencies, thereby preserving the coherence of local behavioral semantics. Therefore, even when different obfuscation tools differ in their transformation strategies, JSCoherence can still extract relatively stable malicious behavior features from DDSPs. At the same time, there remains a certain performance gap between the cross-dataset evaluation results and the in-dataset evaluation results, indicating that cross-obfuscator generalization remains challenging. This is mainly because different obfuscation tools not only include different obfuscation techniques, but even the same type of obfuscation technique may be implemented differently. Therefore, although JSCoherence can alleviate syntax-level perturbations caused by obfuscation to some extent, richer and more diverse obfuscation samples still need to be introduced in open environments to enhance the model’s robustness against unseen obfuscation techniques. Discussion and limitations Discussion Overall, JSCoherence is a lightweight static analysis method that can be viewed as an optimization of existing AST-based static data-flow analysis. By using DDSPs as fine-grained modeling units, JSCoherence reconnects statements fragmented by obfuscation through variable-level data dependencies, thereby recovering locally coherent behavioral semantics. Compared with prior work (Huang et al. 2021; Fang et al. 2022; Ren et al. 2023) and LLM-based detection approaches, the experimental results show that JSCoherence achieves favorable overall performance on obfuscated JavaScript code. Meanwhile, its lightweight feature representation and random-forest-based classifier make it suitable for deployment in scenarios such as client-side real-time attack detection, critical infrastructure protection, and large-scale web script analysis. Beyond detection effectiveness, a practical malicious JavaScript detection system must also consider scalability as the script corpus continuously grows and new obfuscation patterns emerge. For large-scale corpora, when the clustering size exceeds a certain threshold (e.g., 100,000 samples) or the clustering overhead surpasses the available hardware resources, JSCoherence can adopt an incremental cluster expansion strategy to avoid performing full reclustering. Specifically, the existing K cluster centers can be regarded as a set of stable DDSP semantic prototypes. For a newly collected DDSP, we first calculate its distance to the nearest existing cluster center. If the distance is lower than a predefined threshold, the DDSP is considered to still be representable by the existing clusters and is directly assigned to the corresponding cluster. If the distance exceeds the threshold, this indicates that it may contain a new obfuscation pattern or local behavioral semantics that are difficult to cover with the existing clusters, and it can be temporarily stored in an outlier DDSP buffer. The threshold can be determined according to the distance distribution during training. For example, we can compute the distance from each DDSP in the training set to its nearest cluster center and use the 95th or 99th percentile as a reference threshold. When the outlier DDSP buffer reaches a certain size, or when the system performs periodic updates, local clustering can be performed only on these outlier DDSPs to obtain m new cluster centers, which are then appended to the existing cluster centers. Correspondingly, the script-level DDSP distribution representation is expanded from K dimensions to K+m dimensions. Old samples can be padded with 0 in the newly added dimensions, while new samples can construct distribution vectors based on the expanded cluster centers. The random forest classifier can then be retrained when necessary. Compared with performing global K-Means from scratch on a million-scale DDSP corpus, this strategy confines the main update cost to clustering newly emerging outlier DDSPs and updating the script-level classifier. Therefore, it is more suitable for large-scale datasets and continuously evolving obfuscation scenarios. This design choice also distinguishes JSCoherence from existing end-to-end deep learning methods. Deep learning methods represented by graph learning models, such as GNNs, usually require the construction of relatively complete program graphs and end-to-end training and inference on graph structures, which can introduce substantial training and deployment costs in large-scale JavaScript detection scenarios. Fang et al. (2022), which we compare against in our experiments, is a representative malicious JavaScript detection method based on PDG and GNN. The experimental results show that JSCoherence achieves better detection performance with lower time overhead. More importantly, JSCoherence can directly analyze which local behavioral semantics play a key role in classification through representative DDSPs in high-importance clusters. Therefore, JSCoherence achieves a practical balance among detection performance, interpretability, and time overhead. Limitations Despite its effectiveness, JSCoherence still has several limitations. First, JSCoherence builds on DDSPs and is primarily designed for scripts that conceal malicious logic through data dependencies across multiple statements. It does not explicitly target samples whose malicious functionality is fully implemented by a single statement. In such cases, the malicious semantics are confined to a single AST subtree, and the corresponding features remain locally concentrated in the AST sequence rather than being scattered. Existing approaches based on AST sequences or rule matching are often already effective at detecting such patterns. JSCoherence can therefore be combined in a cascaded manner with traditional AST-based methods to achieve more comprehensive detection coverage. Second, as a static analysis method, JSCoherence has inherent limitations when handling dynamically generated code. As shown in Fig. 8, the malicious script gradually concatenates and reconstructs the payload variable OUh through a loop, and finally executes the dynamically generated code via eval(OUh). For such scripts, JSCoherence can extract DDSPs related to the external behavioral process. For example, the representative DDSPs in Fig. 8 capture the construction of the payload variable OUh and its dynamic execution via eval(). However, static analysis methods cannot parse the actual semantic content represented by OUh at runtime, and therefore DDSPs cannot fully characterize the behavioral semantics produced after dynamic execution. As a result, benign scripts with similar reconstruction and dynamic-execution logic may produce highly similar DDSPs, potentially leading to false positives. In our dataset, such patterns occur in only approximately 0.12% of benign samples, compared with 28.51% of malicious samples, indicating that dynamic code generation and execution are much more prevalent in malware and can be considered suspicious external behavioral features. At the same time, the very low occurrence of such patterns in benign samples suggests that the associated false-positive risk for JSCoherence remains limited. Therefore, for dynamically generated code whose payload is constructed and released only at runtime, a reasonable future direction is to integrate dynamic analysis to recover the generated payload and more completely capture the behavioral semantics. Third, JSCoherence analyzes only JavaScript code content and cannot detect escape scripts that transform part of the code into other formats, such as WebAssembly used by Romano et al. (2022) to evade detection. Additionally, although JSCoherence achieves strong performance under obfuscation, obfuscation inevitably introduces a large number of redundant DDSP features. Our clustering-based representation and the feature-importance mechanism of the random forest help to separate semantically simple, highly repetitive, and weakly discriminative DDSPs and reduce their impact, but these redundant features cannot be completely eliminated and thus impose a practical upper bound on performance. Finally, like most learning-based static detection methods, the effectiveness of JSCoherence depends on the quality and coverage of the training data. Its ability to detect previously unseen attack patterns or novel variants remains limited. Continuous expansion and updating of the training corpus are therefore critical for improving its robustness against emerging malicious JavaScript. Although JSCoherence demonstrates strong detection capability, it still has inherent limitations compared with dynamic analysis, particularly when handling dynamically generated code. Therefore, a promising direction for future improvement is to integrate dynamic execution tracing with static data-flow analysis, so as to capture more comprehensive code behavior while preserving the efficiency of static detection. Conclusion This paper presents JSCoherence, a static analysis method for detecting obfuscated malicious JavaScript. JSCoherence uses DDSPs as its core modeling unit to recover locally coherent code semantics that have been fragmented by obfuscation, thereby enhancing the detectability of obfuscated malicious scripts. Experimental results on public datasets and their obfuscated datasets show that JSCoherence consistently outperforms existing static analysis methods. In addition to achieving stronger detection performance, JSCoherence maintains competitive efficiency and offers interpretability by analyzing the semantics of high-importance DDSPs that drive classification decisions. Data availability The data supporting the findings of this study are available from the corresponding author upon reasonable request. References AL-Taharwa IA, Lee H-M, Jeng AB, Wu K-P, Ho C-S, Chen S-M (2015) JSOD: JavaScript obfuscation detector. Secur Commun Netw 8(6):1092–1107 Alon U, Zilberstein M, Levy O, Yahav E (2018) A general path-based representation for predicting program properties. In: Proceedings of the 39th ACM SIGPLAN conference on programming language design and implementation. New York, NY, USA, pp 404–419 Blanc G, Miyamoto D, Akiyama M, Kadobayashi Y (2012) Characterizing obfuscated JavaScript using abstract syntax trees: experimenting with malicious scripts. In: Proceedings of the 2012 26th international conference on advanced information networking and applications workshops. Fukuoka, Japan, pp 344–351 Chen Z, Wang W, Qin Y, Zhang S (2025) ZipAST: enhancing malicious JavaScript detection with sequence compression. Comput Secur 153:104390 Curtsinger C, Livshits B, Zorn B, Seifert C (2011) ZOZZLE: fast and precise in-browser JavaScript malware detection. In: Proceedings of the 20th USENIX security symposium. San Francisco, CA, USA, pp 1–16 DeepSeek: DeepSeek-R1-Distill-Qwen-14B (2025) https://github.com/deepseek-ai/DeepSeek-R1 Esprima: a high performance, standard-compliant ECMAScript parser written in ECMAScript (2019) https://esprima.org/ Fang Y, Huang C, Su Y, Qiu Y (2020) Detecting malicious JavaScript code based on semantic analysis. Comput Secur 93:101764 Fang Y, Huang C, Zeng M, Zhao Z, Huang C (2022) JStrong: malicious JavaScript detection based on code semantic representation and graph neural network. Comput Secur 118:102715 Fass A, Backes M, Stock B (2019) JStap: a static pre-filter for malicious JavaScript detection. In: Proceedings of the 35th annual computer security applications conference. New York, NY, USA, pp 257–269 Fass A, Krawczyk RP, Backes M, Stock B (2018) JaSt: fully syntactic detection of malicious (obfuscated) JavaScript. In: Detection of intrusions and malware, and vulnerability assessment. Lecture Notes in Computer Science 10885:303–325 FastText: a library for efficient learning of word representations and sentence classification (2024) https://github.com/facebookresearch/fastText Geeksonsecurity: malicious JavaScript dataset (2023) https://github.com/geeksonsecurity/js-malicious-dataset Guo W, Song S, Guo J, Xu Z, Liu C, Ou H, Ge M, Liu Y (2026) Bridging expert reasoning and llm detection: a knowledge-driven framework for malicious packages. In: Proceedings of the ACM Web Conference 2026, New York, NY, USA, pp. 3554–3565 Huang C, Wang N, Wang Z, Sun S, Li L, Chen J, Zhao Q, Han J, Yang Z, Shi L (2024) DONAPI: malicious NPM packages detector using behavior sequence knowledge mapping. In: Proceedings of the 33rd USENIX security symposium, Philadelphia, PA, USA, pp. 3765–3782 Huang Y, Li T, Zhang L, Li B, Liu X (2021) JSContana: Malicious JavaScript detection using adaptable context analysis and key feature extraction. Comput Secur 104:102218 Hynek Petrak: JavaScript Malware Collection (2024) https://github.com/HynekPetrak/javascript-malware-collection Javascript-obfuscator: a powerful obfuscator for JavaScript and Node.js (2025) https://github.com/javascript-obfuscator/javascript-obfuscator Jfogs: Javascript code obfuscator (2018) https://github.com/zswang/jfogs Js-transformations: a JavaScript analysis tool (2021) https://github.com/MarM15/js-transformations Jsobfu: a Javascript obfuscator written in Ruby (2025) https://github.com/rapid7/jsobfu Kapravelos A, Shoshitaishvili Y, Cova M, Kruegel C, Vigna G (2013) Revolver: an automated approach to the detection of evasive web-based malware. In: Proceedings of the 22nd USENIX security symposium. USA, pp 637–652 Kim HC, Choi YH, Lee DH (2012) JsSandbox: a framework for analyzing the behavior of malicious JavaScript code using internal function hooking. KSII Trans Internet Inf Syst 6(2):766–783 Kim K, Kim IL, Kim CH, Kwon Y, Zheng Y, Zhang X, Xu D (2017) J-Force: forced execution on JavaScript. In: Proceedings of the 26th international conference on world wide web, Republic and Canton of Geneva, CHE, pp. 897–906 Liang H, Yang Y, Sun L, Jiang L (2019) JSAC: a novel framework to detect malicious JavaScript via CNNs over AST and CFG. In: Proceedings of the 2019 international joint conference on neural networks. Budapest, Hungary, pp 1–8 Liu Z, Fang Y, Huang C, Xu Y (2023) MFXSS: an effective XSS vulnerability detection method in JavaScript based on multi-feature model. Comput Secur 124:103015 MalwareBazaar: malwarebazaar database (2026) https://bazaar.abuse.ch/browse.php Moog M, Demmel M, Backes M, Fass A (2021) Statically detecting JavaScript obfuscation and minification techniques in the wild. In: Proceedings of the 51st annual IEEE/IFIP international conference on dependable systems and networks. Taipei, Taiwan, pp 569–580 Ndichu S, Kim S, Ozawa S, Misu T, Makishima K (2019) A machine learning approach to detection of JavaScript-based attacks using AST features and paragraph vectors. Appl Soft Comput 84:105721 Pantelaios N, Kapravelos A (2024) FV8: a forced execution JavaScript engine for detecting evasive techniques. In: Proceedings of the 33rd USENIX security symposium. Philadelphia, PA, USA, pp 3747–3764 Qin Y, Wang W, Chen Z, Song H, Zhang S (2023) TransAST: a machine translation-based approach for obfuscated malicious JavaScript detection. In: Proceedings of 2023 53rd annual IEEE/IFIP international conference on dependable systems and networks. Porto, Portugal, pp 327–338 Ratanaworabhan P, Livshits B, Zorn B (2009) NOZZLE: a defense against heap-spraying code injection attacks. In: Proceedings of the 18th USENIX security symposium. USA, pp 169–186 Ren K, Qiang W, Wu Y, Zhou Y, Zou D, Jin H (2023) JSRevealer: a robust malicious JavaScript detector against obfuscation. In: 2023 53rd annual IEEE/IFIP international conference on dependable systems and networks. Porto, Portugal, pp 339–351 Rieck K, Krueger T, Dewald A (2010) Cujo: efficient detection and prevention of drive-by-download attacks. In: Proceedings of the 26th annual computer security applications conference. New York, NY, USA, pp 31–39 Romano A, Lehmann D, Pradel M, Wang W (2022) Wobfuscator: obfuscating JavaScript malware via opportunistic translation to WebAssembly. In: Proceedings of the 2022 IEEE symposium on security and privacy. Francisco, CA, USA, pp 1574–1589 Rozi MF, Ozawa S, Ban T, Kim S, Takahashi T, Inoue D (2022) Understanding the influence of AST-JS for improving malicious webpage detection. Appl Sci (Basel) 12(24):12916 Sarker S, Jueckstock J, Kapravelos A (2020) Hiding in plain site: detecting JavaScript obfuscation through concealed browser API usage. In: Proceedings of the ACM internet measurement conference. New York, NY, USA, pp 648–661 Skolka P, Staicu C-A, Pradel M (2019) Anything to hide? Studying minified and obfuscated code in the web. In: Proceedings of the 28th international conference on world wide web. New York, NY, USA, pp 1735–1746 Song X, Chen C, Cui B, Fu J (2020) Malicious JavaScript detection based on bidirectional LSTM model. Appl Sci (Basel) 10:3440 Tranco: a research-oriented top sites ranking (2025) https://tranco-list.eu/ Wang J, Li Z, Qu J, Zou D, Xu S, Xu Z, Wang Z, Jin H (2025) MalPacDetector: an LLM-based malicious NPM package detector. IEEE Trans Inf Forensics Secur 20:6279–6291 Wang J, Xue Y, Liu Y, Tan TH (2015) JSDC: a hybrid approach for JavaScript malware detection and classification. In: Proceedings of the 10th ACM symposium on information, computer and communications security. New York, NY, USA, pp 109–120 Yu Z, Wen M, Guo X, Jin H (2024) Maltracker: a fine-grained NPM malware tracker copiloted by LLM-enhanced dataset. In: Proceedings of the 33rd ACM SIGSOFT international symposium on software testing and analysis. New York, NY, USA, pp 1759–1771 Zhang X, Du X, Chen H, He Y, Niu W, Li Q (2025) Automatically generating rules of malicious software packages via large language model. In: Proceedings of the 55th annual IEEE/IFIP international conference on dependable systems and networks. Naples, Italy, pp 734–747 Acknowledgements This work was supported by the National Natural Science Foundation of China under Grant no. 62272486. Author information Authors and Affiliations Contributions Zixian Chen: original draft, Methodology. Weiping Wang: review & editing, Funding acquisition. Zesong Gu: data curation. Hong Song: review & editing. Corresponding author Ethics declarations Competing interests The authors declare no conflict of interest. Additional information Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations. Rights and permissions Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. About this article Cite this article Chen, Z., Wang, W., Gu, Z. et al. JSCoherence: detecting obfuscated malicious JavaScript via data-dependent statement pairs. Cybersecurity 9, 212 (2026). https://doi.org/10.1186/s42400-026-00645-9 Received: Accepted: Published: Version of record: DOI: https://doi.org/10.1186/s42400-026-00645-9