  Malicious scripts are an important computer infection threat vector. Our
analysis reveals that the two most prevalent types of malicious scripts include
JavaScript and VBScript. The percentage of detected JavaScript attacks are on
the rise. To address these threats, we investigate two deep recurrent models,
LaMP (LSTM and Max Pooling) and CPoLS (Convoluted Partitioning of Long
Sequences), which process JavaScript and VBScript as byte sequences. Lower
layers capture the sequential nature of these byte sequences while higher
layers classify the resulting embedding as malicious or benign. Unlike
previously proposed solutions, our models are trained in an end-to-end fashion
allowing discriminative training even for the sequential processing layers.
Evaluating these models on a large corpus of 296,274 JavaScript files indicates
that the best performing LaMP model has a 65.9% true positive rate (TPR) at a
false positive rate (FPR) of 1.0%. Similarly, the best CPoLS model has a TPR of
45.3% at an FPR of 1.0%. LaMP and CPoLS yield a TPR of 69.3% and 67.9%,
respectively, at an FPR of 1.0% on a collection of 240,504 VBScript files.
