Difference with JStap about jast HOT 1 CLOSED

Thank you for reaching out.

Both JaSt and JStap are malicious JavaScript detectors. JaSt was our initial work (published in 2018) and JStap (published in 2019) is a refinement, which is more modular and enables to detect malicious JS more precisely.

At a high level (see enclosed figures):

• JaSt works at AST (Abstract Syntax Tree) level to distinguish benign from malicious JS;

• JStap goes beyond relying on the pure code syntax by also considering control and data flow information (i.e., considers more semantic information). JStap is composed of ten modules (we define a "module" based on a chosen code abstraction, like AST or Data Flow Graph, and the way we extract features). Modules can be used both independently or combined, for a higher detection accuracy.

One of JStap module (AST + n-gram features) is conceptually identical to JaSt. Note that due to some slight improvements (I can be more verbose here if necessary), this JStap module has a slightly higher detection accuracy than JaSt (on the same dataset).
You can find precise detection performance numbers in Sections 3.2 and 3.3 of our JStap paper.

I hope this answers your question. I am happy to clarify or be more verbose if necessary.

from jast.